Can a managed CAP file break the Java map during installation?

I have a Java card that works great:

GlobalPlatfomPro:: gp -list
AID: A000000003000000 (|........|)
     ISD OP_READY: Security Domain, Card lock, Card terminate, Default selected,
 CVM (PIN) management

      

I am writing a simple program to return an APDU buffer on every command received:

public class BArrayReturner extends Applet {

    public static byte[] theArray={(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff};
    public static short arrayLength=0;

    private BArrayReturner() {

    }

    public static void install(byte bArray[], short bOffset, byte bLength)
            throws ISOException {

        new BArrayReturner().register();
        BArrayReturner.arrayLength=(short)bArray.length;
        Util.arrayCopyNonAtomic(bArray, (short)0,BArrayReturner.theArray , (short) 0, BArrayReturner.arrayLength);    
    }

    public void process(APDU apdu) throws ISOException {
        byte[] buffer=apdu.getBuffer();
        Util.arrayCopyNonAtomic(BArrayReturner.theArray, (short)0,buffer , (short) 0, (short)0x40); 
        apdu.setOutgoingAndSend((short)0, (short)255);
    }

}

      

After converting the above program to a file, .cap

I opened the cap file with WinRAR and changed one byte of the .CAP file as shown below:

(I replaced class.cap 0x78

instead 0x07

in the ninth class).

Click to enlarge:

enter image description here

Now I tried to install this new cap file. But not only the installation failed, but I can no longer list the contents of my map:

GlobalPlatfomPro:: gp -list -v -d
# Detected readers
[*] ACS CCID USB Reader 0
SCardConnect("ACS CCID USB Reader 0", T=*) -> T=0
SCardBeginTransaction("ACS CCID USB Reader 0")
Reader: ACS CCID USB Reader 0
ATR: 3B68XxXxXxXxXxXx009000
More information about your card:
    http://smartcard-atr.appspot.com/parse?ATR=3B68XxXxXxXxXxXx009000

A>> T=0 (4+0000) 00A40400 00
A<< (0000+2) (20ms) 6F00
SCardEndTransaction()
SCardDisconnect("ACS CCID USB Reader 0", false)
Exception in thread "main" java.lang.IllegalStateException: No selected ISD!
        at openkms.gp.GlobalPlatform.openSecureChannel(GlobalPlatform.java:327)
        at openkms.gp.GPTool.main(GPTool.java:280)

      

My question is:

What happened on my smart card with this newly generated CAP file? Does anyone have any idea of ​​the byte codes and the meaning of that byte in the source and the managed file? Is this a good logical answer for installing managed files?

Note1:

I have also tried installing this new cap file on my JCOP card. The installation failed, but instead of the error above, the card will shut down for about 15 minutes. (It should take about 15 minutes to read memory cards!)

Note 2:

I tried to change the 10th byte of this file instead of the 9th byte. So I replaced 0x01

with 0x45

. After that, I installed the new CAP file successfully! Should the card detect this manipulation after checking the bytecode and prevent installation?

+3


source to share


1 answer


You have successfully activated the defense mechanisms on the map! Depending on what you do, the bytecode verifier either fails, disconnects the card, or passes the test. the cap file is just a container. If you want a deeper anaylsis you need to know more about the actual Java Card byte code



+2


source







All Articles