Communication Parameters 38400 Baud, 1 Startbit, 1 Stopbit, no Parität

…

The Legic command SEARCH_TXP is correct to capture the UID.


0x04 01 02 CRC_H CRC_L will look out for an ISO 14443A transponder

0x04 = Length of bytes to follow
0x01 = Command code
0x02 = Transponder type, ISO 14443A
CRC_H = 0x00 allowed as test value
CRC_L = 0x00 allowed as test value

Transponder types:
0x00 = LEGIC RF standard
0x01 = ISO 15693
0x02 = ISO 14443 A
0x03 = ISO 14443 B
0x04 = INSIDE Secure
0x05 = SONY FeliCa subset

Examples with correct CRC:
04 01 00 43 8A = SEARCH_TXP for Legic
04 01 01 52 03 = SEARCH_TXP for ISO 15693 (I-Code SLI, μD, etc.)
04 01 02 60 98 = SEARCH_TXP for ISO 14443 A (Mifare, Ultralight, etc.)
04 01 03 71 11 = SEARCH_TXP for ISO 14443 B
04 01 04 05 AE = SEARCH_TXP for INSIDE Secure
04 01 05 14 27 = SEARCH_TXP for SONY FeliCa subset

…

The checksum is according to the description of the communication protocol CRC-CCITT (CRC-16) with this generator polynomial x^16 + x^12 + x^5 + 1 and the start value 0xFFFF, Big Endian, Reversed 0x8408.

But according to the documentation it is allowed to simply send 0x0000.

Online calculation: http://crccalc.com => CRC-16/MCRF4XX

…

Example code for CRC calculation:

unsigned int CRC16(unsigned char * p, int n)
{
int i;
int k;
unsigned int polynom = 0x8408; // CCITT
unsigned int crc = 0xFFFF; // inital value
for (i = 0; i < n; i++)
{
crc ^= p[i];
for (k = 0; k < 8; k++)
{
if (crc & 1) crc = (crc >> 1) ^ polynom;
else crc = crc >> 1;
}
}
return crc;
}
