From 5e3fac260b4291c57f676efe0789cacd2842d8bb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=90=D0=BD=D1=82=D0=BE=D0=BD=20=D0=A2=D1=80=D0=BE=D1=88?= =?UTF-8?q?=D0=B8=D0=BD?= Date: Wed, 16 Sep 2026 08:10:24 +0300 Subject: [PATCH] docs: RAM install over SCP81 live-verified end-to-end INSTALL [for load] -> LOAD x6 -> INSTALL [for install] (SW 9000) against the live card. Records the parameter-less 6A80 finding and the working INSTALL [for install] command built from the Remote APDU -> RAM form and queued via "Queue in SCP81". --- docs/scp81-findings.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/docs/scp81-findings.md b/docs/scp81-findings.md index f78134b..0b8abb8 100644 --- a/docs/scp81-findings.md +++ b/docs/scp81-findings.md @@ -229,6 +229,22 @@ could never install there either. (`range(0, len(tlv), 240 * 2)`), with a reassembly test that pins the joined blocks to the C4 TLV byte for byte. +## RESOLVED 2026-09-16e: RAM install over SCP81 - complete and verified + +**Live-verified end-to-end**: .cap parse -> INSTALL [for load] (SW 9000) -> +LOAD x6 (all SW 9000, after the block-slicing fix) -> INSTALL [for install] +with the full parameter set -> SW 9000. The applet's INSTALL [for install] +needed the real install parameters (`C900` + the STK parameters +`EA 0C 80 0A ...`), which the compact SCP81 form could not express - the +Remote APDU -> RAM -> INSTALL [for install] builder has all the fields and +its "Queue in SCP81" button feeds the commands straight into the HTTP OTA +script (the "To expanded" button shows them in the TS 102 226 command +scripting (AA/AE80) form). The card's answer for the parameter-less attempt +was SW 6A80 (incorrect parameters in data field). + +Working INSTALL [for install] example (compact): +`80E60C002E07AA1902BC22580108AA1902BC2258010108AA1902BC22580101010010C900EA0C800A00000F010000000000000000` + ## Next tests / work 1. **UI:** group the per-page R-APDUs under their logical command in the