> For the complete documentation index, see [llms.txt](https://developer.magtek.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.magtek.com/hardware/card-readers/mms-dyna-devices/dynaflex-ii-go/documents/developers-manuals/programmers-manual-commands/commands/nfc-mifare-pass-through/pass-through-for-mifare-classic-mini-plus-sl1.md).

# Pass Through for MIFARE Classic/MINI/Plus SL1

### Command 0x1101 – Pass Through Command for MIFARE Classic/MINI®/Plus SL1 (Security Level 1), Type 2

After a MIFARE Tag is activated, the host uses this command to send commands and receive responses to and from a MIFARE tag.

For MIFARE Plus EV1/EV2/SE/X at SL1 (Security Level 1), the tag is discovered as MIFARE Classic, and can use the same functionality as MIFARE Classic 1K/4K commands in **Table 96 – MIFARE Classic/MINI® Commands**. Furthermore, an additional optional AES authentication is available in this level without affecting the MIFARE Classic 1K/4K functionality. The authenticity of the card can be proven using strong cryptographic means with this additional functionality. In addition to the backwards compatibility mode, MIFARE Plus card can be switched to higher security levels. After MIFARE Plus is authenticated with AES Security Level 1 Key, the Device doesn’t auto detect an error from the MIFARE Tag has been removed to end the pass-through session. To end the pass-through session, the Host application can send the last command, the CANCEL command (0xFF), or receive an error response from the MIFARE Tag.

## Table - Request Data for Command 0x1101 - Pass Through Command for MIFARE Classic/MINI®/Plus SL1 (Security Level 1)

<table><thead><tr><th width="112">Tag</th><th width="68.66668701171875">Len</th><th width="341">Value / Description</th><th width="77.00006103515625">Typ</th><th width="77.3333740234375">Req</th><th width="96">Default</th></tr></thead><tbody><tr><td>Beginning of any wrappers, at minimum including <strong>Request Message</strong> </td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>1101 = <strong>Command 0x1101 – Pass Through Command for MIFARE Classic/MINI®/Plus SL1 (Security Level 1), Type 2</strong></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>81</td><td>var</td><td>Command to Send. See <strong>Table 96 – MIFARE Classic/MINI® Commands</strong> See <strong>Table 97 – MIFARE Plus EV1/EV2/SE/X SL1 (Security Level 1) Commands</strong></td><td>B</td><td>R</td><td></td></tr><tr><td>82</td><td>01</td><td>00 – No Encrypt 01 - Encrypt</td><td></td><td></td><td></td></tr><tr><td>83</td><td>01</td><td>00 – Expect More Commands 01 – FF (Last Command). If last command, Device will provide a single beep after receiving a successful response from tag, otherwise, device will provide a double beep.</td><td>B</td><td>R</td><td></td></tr><tr><td>End of any wrappers, at minimum including Request Message </td><td></td><td></td><td></td><td></td><td></td></tr></tbody></table>

## Table – MIFARE Classic/MINI® Commands

<table><thead><tr><th width="135.6666259765625">Command</th><th width="94.66668701171875">Length</th><th>Field Value</th></tr></thead><tbody><tr><td>MIFARE Read</td><td></td><td>Byte 0 – 0x30 – Read Command<br>Byte 1 – Sector Number to Read<br>Byte 2 – Start Block Number<br>Byte 3 – End Block Number<br>Byte 4 – Key Type, 0 = A, 1 = B<br>Byte 5 to 10 = 6 Byte Key</td></tr><tr><td>MIFARE Write</td><td></td><td>Byte 0 – 0xA0 – Write Command<br>Byte 1 – Sector Number to Write<br>Byte 2 – Start Block Number<br>Byte 3 – End Block Number<br>Byte 4 – Key Type 0 = A, 1 = B<br>Byte 5 to 10 = 6 Byte Key<br>Byte 11 to x = Variable length Byte Data (16 bytes per block)</td></tr><tr><td>MIFARE Increment</td><td></td><td>Byte 0 – 0xC1 – Increment Command<br>Byte 1 – Source Sector Number<br>Byte 2 – Source Block Number<br>Byte 3 – Key Type 0 = A, 1 = B<br>Byte 4 to 9 = 6 Byte Key<br>Byte 10 to 13 = 4 Byte Operand</td></tr><tr><td>MIFARE Decrement</td><td></td><td>Byte 0 – 0xC0 – Decrement Command<br>Byte 1 – Source Sector Number<br>Byte 2 – Source Block Number<br>Byte 3 – Key Type 0 = A, 1 = B<br>Byte 4 to 9 = 6 Byte Key<br>Byte 10 to 13 = 4 Byte Operand</td></tr><tr><td>MIFARE Restore</td><td></td><td>Byte 0 – 0xC2 – Restore Command<br>Byte 1 – Source Sector Number<br>Byte 2 – Source Block Number<br>Byte 3 – Key Type 0 = A, 1 = B<br>Byte 4 to 9 = 6 Byte Key</td></tr><tr><td>MIFARE Transfer</td><td></td><td>Byte 0 – 0xB0 – Write the value from the Transfer Buffer into destination block number<br>Byte 1 – Destination Sector Number<br>Byte 2 – Destination Block Number<br>Byte 3 – Key Type 0 = A, 1 = B<br>Byte 4 to 9 = 6 Byte Key</td></tr></tbody></table>

## Table – MIFARE Plus EV1/EV2/SE/X SL1 (Security Level 1) Commands

<table><thead><tr><th width="116">Command</th><th width="93.33331298828125">Length</th><th width="266.33331298828125">Field Value</th><th width="76">EV1</th><th width="76.6666259765625">EV2</th><th width="66.66668701171875">SE</th><th width="59.6666259765625">X</th></tr></thead><tbody><tr><td>First Authenticate (part1 and part2)</td><td>3</td><td><p>First Authenticate. Use this command to switch to higher security levels. This command is behaved as the last command. Device will provide a single beep after receiving a successful response from a card, otherwise, device will provide a double beep.</p><p><br>Byte 0 = 0x70<br>Byte 1-2 = Level 2 Switch Key (MIFARE Plus X only), or Level 3 Switch Key. See NXP doc ds206234, table 113.<br>Byte 3 = MIFARE Plus AES_Key#<br>- 0x01 = AES_Key1 = 16 bytes value stored in Property 1.2.1.1.4.5 MIFARE Plus AES_Key1.<br>- 0x02 = AES_Key2 = 16 bytes value stored in Property 1.2.1.1.4.6 MIFARE Plus AES_Key2.<br>- 0x03 = AES_Key3 = 16 bytes value stored in Property 1.2.1.1.4.7 MIFARE Plus AES_Key3.<br>- 0x04 = AES_Key4 = 16 bytes values stored in Property 1.2.1.1.4.8 MIFARE Plus AES_Key4.<br>- 0x05 = AES_Key5 = 16 bytes values stored in Property 1.2.1.1.4.9 MIFARE Plus AES_Key5.<br>- 0x06 = AES_Key6 = 16 bytes values stored in Property 1.2.1.1.4.A MIFARE Plus AES_Key6.</p></td><td>Y</td><td>Y</td><td>Y</td><td>Y</td></tr><tr><td>Following Authenticate (part 1 and part 2)</td><td>3</td><td>Following Authenticate. Use this command for an option to put the NFC tag in Security Level 1 AES Authenticated before sending MIFARE Classic commands.<br>Byte 0 = 0x76<br>Byte 1-2 = Security Level 1 Card Authentication Key. See NXP doc ds206234, table 113.<br>Byte 3 = MIFARE Plus AES_Key# (same key numbering as First Authenticate)</td><td>Y</td><td>Y</td><td>Y</td><td>Y</td></tr><tr><td>READ_SIG</td><td>2</td><td>The READ_SIG command returns an IC-specific, 48-byte ECC originality check signature.<br>Byte 0 = 0x3C<br>Byte 1 = 0x00, RF</td><td>Y</td><td>Y</td><td>N</td><td>N</td></tr><tr><td>Personalize UID</td><td>2</td><td><p>Set anti-collision, selection and authentication behavior. The execution of this command requires an authentication to MF Classic sector 0 (use MIFARE Read command sector 0 from <strong>Table 96 – MIFARE Classic/MINI® Commands</strong>). </p><p></p><p>Once this command has been issued and accepted by the PICC, the configuration is automatically locked. A subsequently issued ‘Personalize UID Usage’ command is not executed and fails.<br></p><p>Byte 0 = 0x40<br>Byte 1 = Encoded type of UID usage:<br>- 0x00 = UIDF0 = anti-collision and selection with the double size UID (7-byte) according to ISO/IEC14443-3<br>- 0x40 = UIDF1 = anti-collision and selection with the double size UID (7-byte) according to ISO/IEC14443-3 and optional usage of a selection process shortcut<br>- 0x20 = UIDF2 = anti-collision and selection with a single size random ID (4-byte) according to ISO/IEC14443-3. After the card is configured with random ID, it won’t be able to perform any MF Classic authentication since MF Classic authentication requires UID.<br>- 0x60 = UIDF3 = anti-collision and selection with a single size NUID (4-byte) according to ISO/IEC14443-3 where the NUID is calculated out of the 7-byte UID</p></td><td>Y</td><td>Y</td><td>N</td><td>N</td></tr><tr><td>CANCEL</td><td>1</td><td><p>This command is used to terminate the pass-through command session.</p><p><br>Byte 0 = 0xFF</p></td><td>Y</td><td>Y</td><td>Y</td><td>Y</td></tr></tbody></table>

## Table - Response Data for Command 0x1101 – Pass Through Command for MIFARE Classic/MINI®/Plus SL1 (Security Level 1), Type 2

<table><thead><tr><th width="110.66665649414062">Tag</th><th width="75.3333740234375">Len</th><th width="366">Value / Description</th><th width="77.66668701171875">Typ</th><th width="79.333251953125">Req</th><th width="102.0001220703125">Default</th></tr></thead><tbody><tr><td>Beginning of any wrappers, at minimum including Response Message </td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>1101 = <strong>Command 0x1101 – Pass Through Command for MIFARE Classic/MINI®/Plus SL1 (Security Level 1), Type 2</strong></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>81</td><td>var</td><td><p>Tag Response Code</p><p><br>Byte 0 = 0x00 = Success</p><p><br>Byte 0 = 0x01 = I/O Failed<br>Byte 0 = 0x02 = Authentication Failed<br>Byte 1 = 0x01 = Block that Failed (optional)</p></td><td>B</td><td>R</td><td>N/A</td></tr><tr><td>82</td><td>var</td><td>Encryption Control. If encrypted, see <strong>Table 93 - Payload for Encrypted NFC/MIFARE Data</strong>. If unencrypted see <strong>Table 94 – Unencrypted NFC/MIFARE Data</strong>.</td><td>B</td><td>O</td><td>N/A</td></tr><tr><td>End of any wrappers, at minimum including Response Message </td><td></td><td></td><td></td><td></td><td></td></tr></tbody></table>

{% hint style="info" %}
If the request started successfully, the Request Status in the message wrapper is: OK, Started / Running, All good / requested operation was successful.
{% endhint %}

## Table - Request Example (Read Sector 0, Block Number Start 0 - End 0, KeyType A, Key = FFFFFFFFFFFF)

{% code title="Example (Hex)" %}

```
AA 00 81 04 01 19 11 01 84 15 11 01 81 0B 30 00 00 00 00 FF FF FF FF FF FF 82 01 00 83 01 00
```

{% endcode %}

## Table - Response Example (Read Sector 0, Block Number Start 0 - End 0, KeyType A, Key = FFFFFFFFFFFF)

{% code title="Example (Hex)" %}

```
AA 00 81 04 82 19 11 01 82 04 01 00 00 00 84 1C 11 01 81 01 00 82 15 FC 13 DF 7A 10 A4 FB 0D 3E
6C 08 04 00 03 0D C0 90 EE BF BB 1D

```

{% endcode %}

## Table - Payload for Encrypted NFC/MIFARE Data

<table><thead><tr><th width="101.99996948242188">Tag</th><th width="75.33331298828125">Len</th><th>Value / Description</th><th width="73.3333740234375">Typ</th><th width="77">Req</th><th>Default</th></tr></thead><tbody><tr><td>/DFDF59</td><td>var</td><td>Encrypted Data Primitive. Decrypt the value of this TLV data object using the algorithm and variant specified in the <strong>Encrypted Data KSN</strong> parameter and the <strong>Encrypted Data Encryption Type</strong> parameter to read its contents. The format of the decrypted data is shown in <strong>Table 360</strong>.</td><td>B</td><td>R</td><td></td></tr><tr><td>/DFDF50</td><td>var</td><td>Encrypted Data KSN</td><td>B</td><td>R</td><td></td></tr><tr><td>/DFDF51</td><td>01</td><td>Encrypted Data Encryption Type. See section 4.4 Encryption Type for a list of valid values.</td><td>B</td><td>R</td><td></td></tr><tr><td>End of any wrappers, at minimum including Response Message </td><td></td><td></td><td></td><td></td><td></td></tr></tbody></table>

## Table – Unencrypted NFC/MIFARE Data

| Tag   | Len | Value / Description       | Typ | Req | Default |
| ----- | --- | ------------------------- | --- | --- | ------- |
| FC    | var | NFC/MIFARE Data Container | T   | R   |         |
| /DF7A | var | NFC/MIFARE Data           | B   | O   |         |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://developer.magtek.com/hardware/card-readers/mms-dyna-devices/dynaflex-ii-go/documents/developers-manuals/programmers-manual-commands/commands/nfc-mifare-pass-through/pass-through-for-mifare-classic-mini-plus-sl1.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.