M1 card change secret password just to change the first one sector

1, M1 card is divided into 16 sectors, each sector by 4 blocks (block 0, block 1, block 2, block 3).
2, block 0 sector 0 (ie, the absolute address 0), which is used to store vendor code, has been cured, can not be changed.
3, each sector of the block 0, block 1, block 2 for the data blocks can be used to store data.
★ be used for general data retention, you can read, write operation.
★ used as a data value, can be initialized value, value-added, impairment, reading the value of operations.
4, each sector of the block 3 for the control block, including a password A, access control, passwords, B. Password A (6 bytes) Access Control (4 bytes) Password B (6 bytes)
5, each sector of the password and access control are independent and can be based on actual need to set their own passwords and access control. Access control is 4 bytes, a total of 32-bit, sector of each block (including data blocks and control blocks) conditions of access passwords and access control by joint decision, in access control for each block has a corresponding three control bits, defined as follows:

Block 0: C10 C20 C30
Block 1: C11 C21 C31
Block 2: C12 C22 C32
Block 3: C C23 C33

Three control bits for two forms of positive and anti-exist in the access control byte, decided to block access to the (such as impairment operation must verify KEY A, for value-added operation must verify KEY B, etc.). Three control bits in the access control byte in the position to block 0 as an example:

M1 Card Introduction
1, M1 card key indicators
 a capacity of 1K-bit EEPROM
 is divided into 16 sectors, each sector is 4 blocks, each block of 16 bytes, in order to block the access unit
 Each sector has a separate set of passwords and access control
 Each card has a unique serial number, for the 32-bit
 with the anti-collision mechanism to support multi-card operation
 No power, comes with antenna, includes encryption control logic and communication logic circuit
 data retention period of 10 years, can be rewritten 100,000 times, read many times
 Operating temperature: -20 ℃ ~ 50 ℃ (temperature 90%)
 Operating frequency: 13.56MHZ
 Communication Rate: 106KBPS
 read-write distance: 10mm or less (with the reader-related)

Access Control (4 bytes, in which an alternative byte 9 byte) structure is as follows:
bit 7 6 5 4 3 2 1 0
Byte 6 C23_b C22_b C21_b C20_b C13_b C12_b C11_b C10_b
Byte 7 C13 C12 C11 C10 C33_b C32_b C31_b C30_b
Byte 8 C33 C32 C31 C30 C23 C22 C21 C20
Byte 9
(Note: _b said Invert)

6, the data block (block 0, block 1, block 2) access control are as follows:
Control bit (X = 0 .. 2)
Access conditions (on the data blocks 0,1,2)
C1X C2X C3X Read Write Increment Decrement, transfer,
Restore
0 0 0 KeyA | B KeyA | B KeyA | B KeyA | B
0 1 0 KeyA | B Never Never Never
1 0 0 KeyA | B KeyB Never Never
1 1 0 KeyA | B KeyB KeyB KeyA | B
0 0 1 KeyA | B Never Never KeyA | B
0 1 1 KeyB KeyB Never Never
1 0 1 KeyB Never Never Never
1 1 1 Never Never Never Never
(KeyA | B that A password or password B, Never, under any conditions that can not be achieved)

For example: When the block 0 of access control bits C10 C20 C30 = 1 0 0, the authentication password A and password B is correct-readable;
Verify that the password B is correct to write; can not be value-added, impairment operation.

7, Beijing M1 card control access to departments and regions, three control and data blocks (blocks 0,1,2) different, and its access control are as follows: Password A password access control B
C13 C23 C33 Read Write Read Write Read Write
0 0 0 Never KeyA | B KeyA | B Never KeyA | B KeyA | B
0 1 0 Never Never KeyA | B Never KeyA | B Never
1 0 0 Never KeyB KeyA | B Never Never KeyB
1 1 0 Never Never KeyA | B Never Never Never
0 0 1 Never KeyA | B KeyA | B KeyA | B KeyA | B KeyA | B
0 1 1 Never KeyB KeyA | B KeyB Never KeyB
1 0 1 Never Never KeyA | B KeyB Never Never
1 1 1 Never Never KeyA | B Never Never Never
For example: when the blocks of three access control bits C13 C23 C33 = 1 0 0, it said:
Password A: unreadable, verify KEYA or KEYB correct, may write (change).
Access Control: Verify KEYA or KEYB is correct, readable, writable.
Password B: Verify KEYA or KEYB is correct, readable, writable.

3, M1 card works
The electrical part of the card by only one antenna and ASIC component. Beijing M1 Card
Antenna: The antenna is only a few cards winding coil group, it is suitable for packaging into the IS0 card. Beijing M1 Card
ASIC: Card of the ASIC by a high-speed (106KB baud rate) of the RF interface, a control unit and an 8K-bit EEPROM component.
How it works: M1 card reader issued to a group of fixed-frequency electromagnetic waves, the card has a LC series resonant circuit, its frequency and firing frequency of hearing the same writer, in the electromagnetic wave excitation, LC resonant circuit to resonate, thereby With the charge inside the capacitor in this capacitor the other side then there is a single wizard-pass the electronic pump, the capacitor charge storage capacitor to another, when the accumulated charge to 2V, the capacitor can be used as power for other circuits operating voltage, data transmission will be the card reader out of, or access data. Beijing M1 Card
4, Beijing M1 Card M1 RF card and reader communication
Changes in sector

Reset Response (Answer to request)
M1 RF card communication protocol and communication baud rate is defined, when a card into the reader operating range, the reader to a specific protocol with its communication, in order to determine whether the card M1 RF card, that is, Verify the card-type card.

Anti-collision mechanism (Anticollision Loop)
When multiple cards into the reader operating range, the anti-collision mechanism will choose one from which to operate, is not selected while in idle mode waiting for the next election cards, the process will return the selected card's serial number.

Select Card (Select Tag)
Option was selected card's serial number, while the capacity to return the card code.

Mutual recognition of three (3 Pass Authentication)
Selected to deal with the card after the reader to determine the number of sectors to access and verify the password in the Password sector, in the third after mutual authentication can be encrypted communication streams. (In select another sector, then to proceed to another sector cryptographic checksum.) Beijing M1 Card

The operation of the data block
Reading (Read): Read one block;
Write (Write): write a block;
Canada (Increment): blocks of the numerical value-added;
Reduction (Decrement): impairment of the value of blocks;
Storage (Restore): will block the contents of the deposit to the data register;
Transfer (Transfer): the data register the contents of the write block;
Suspension (Halt): suspension of the card placed in working condition