I was able to reverse part of the protocol this beast speaks, currently I am able to read tracks, eject card and reset device. It was a rather tedious but fun task, learned quite some new tricks. The layer 1 is R232 and what took me 4 hours to figure out is that you absolutely need to send the Data Set Ready (DSR) signal prior to sending commands.


It is a rather simple binary protocol over R232, here is a small excerpt of my debugging output :
On the left wee see the Hexadecimal representation of the protocol, on the right the ASCII display.

RESET command
Request: 2/20/2009 7:23:07 PM.01564
10 02 43 30 30 10 03 40 - ..C00..@
Answer: 2/20/2009 7:23:07 PM.01564 (+0.0000 seconds)
10 06 - ..
Request: 2/20/2009 7:23:07 PM.12564 (+0.1094 seconds)
10 05 - ..
Answer: 2/20/2009 7:23:09 PM.59364 (+2.4688 seconds)
10 02 50 30 30 30 31 10 03 52 - ..P0001..R

Interpreting :
The first command send is Hex (10 02 43 30 30 10 03 4) which interpreted stands for <DLE><STX>C00<DLE><ETX>@
  • DLE = (Data Link Escape, ASCII Code 127)
  • STX = (Start of TeXt, ASCII Code 2)
  • ETX = (End of TeXt, ASCII Code 3)

The command itself sits in the middle, namely C00, which is the reset command. The protocol flow itself is a simple handshake flow, in tcpish terms : SYN | SYN ACK | SYN-ACK 2 | ACK |

The command ACK is alwas 10 06.

I then started to implement the communication protocol in C#, here is a screenshot of the current prototype, the "Omron Communicator" in C#.


After searching the web for parts of the reversed protocol I was able to find a complete specification of the device together with the protocol documentation. Since this is difficult to find without detailed knowledge I am going to mirror the pdf on this site for google to gather it under the relevant keywords.






4 comments

Anonymous said... @ 25 April, 2009 16:28

thanks for that useful information

Anonymous said... @ 22 June, 2010 11:58

Bonjour

Voila j’ai récupère un lecteur ttl carte 3S4YR-MKW1PC-01 et je cherche
La connexion RDP / RCP / CLS

http://www.omron247.com/doc/pdfcatal.nsf/9A84D2C9161F001586256921004B0D81/$FILE/D23MKW0600.pdf

Merci de votre aide


http://forums.futura-sciences.com/attachments/electronique/113718d1276850531-lecteur-ttl-carte-3s4yr-mkw1pc-01-3s4yr-mkwoegif

http://www.abcelectronique.com/forum/showthread.php?t=66618

Anonymous said... @ 23 July, 2011 14:18

if you want write with it: have a try with this:
http://gaul1.lifesim.de/prg/magstripe/index.html

tom said... @ 10 February, 2013 19:41

hi, did anybody get the a write function working? When i use the write function C71 the reader only accepts numeric characters "0-9" and "<>:" as data.

e.g.
C731234 --> works, writes "1234" in Track 1
C73test --> gives an negative response "02"

thanks

tom

Post a Comment