salmg/academy
Sign in
Setup guides

How do I send my very first APDU to a payment card?

Find the card, then ask it for its payment directory. Two steps, and the second one is the same on every EMV card on earth.

With a PN532 you first put a card in the field and get hold of it. The frame is D4 4A MaxTg BrTy: the command code 4A for InListPassiveTarget, how many targets you will accept, and which radio flavour to look for. MaxTg should not exceed 0x02 — the chip handles two at once at most — and for a payment card the baud rate byte is almost always 0x00.

BrTyMeaning
0x00106 kbps type A — ISO/IEC 14443 Type A. Start here.
0x01212 kbps, FeliCa polling
0x02424 kbps, FeliCa polling
0x03106 kbps type B — ISO/IEC 14443-3B. Try this if type A finds nothing.
0x04106 kbps Innovision Jewel tag

With a card selected, the first thing worth asking any payment card is which applications it offers. That is a SELECT of the Proximity Payment System Environment — an ordinary ISO 7816-4 SELECT whose data field is the ASCII name of the directory.

00CLAA4INS · SELECT04P1 · by name00P20ELc · 14 bytes2PAY.SYS.DDF01the directory name, in ASCII00Le
SELECT PPSE, the contactless entry point. The name is literally the ASCII text 2PAY.SYS.DDF01, fourteen bytes, which is why Lc is 0E. On the contact interface the same command carries 1PAY.SYS.DDF01 instead — one character different, and the single most useful byte to remember in EMV.

The card answers with a template listing the applications it supports, each with an Application Identifier. That response is the beginning of every capture in this site's corpus, so once you have it you can compare your own card against a worked example rather than reading in the dark.