reading EMV card using PPSE and not PSE

Question

I'm trying to read the data off a contactless Visa Paywave card.

For the Paywave, I have to submit a SELECT using PPSE (2PAY.SYS.DDF01) instead of PSE (1PAY.SYS.DDF01).

The EMV book 1, section 11.3.4, table 43 only describes how to interpret the response for a successful SELECT command using PSE. Does anyone know or can refer me to a source that shows how to process the data returned from a successful SELECT command using PPSE?

Here's my request APDU:

00A404000e325041592e5359532e444446303100

Here's the response:

6F2F840E325041592E5359532E4444463031A51DBF0C1A61184F07A0000000031010500A564953412044454249548701019000

I understand tag 84, tag 85, tag BF0C from the response. According to the examples for reading PSE, I should be able to just send GET PROCESSION OPTIONS (to get the AIP and AFL) with PDOL = null after this successful response as follows: 80A80000830000.

But request 80A80000830000 returns error code 6985 - Command not allowed; conditions of use not satisfied.

I also tried reading all the files after successfully selecting the PPSE by traversing through every single SFI (0-30) and every single record (0-16) of each SFI. Yes, I also did the 3 bit shift and bitwise-OR the SFI with 0x4. But I got no data.

I'm stuck, any help that would point me into getting some info from my Paywave card would be appreciated!

Answer 1

Have you tried this tool from EMVLAB http://www.emvlab.org/emvtags/

Using that tool,

http://www.emvlab.org/tlvutils/?data=6F2F840E325041592E5359532E4444463031A51DBF0C1A61184F07A0000000031010500A564953412044454249548701019000