ux: make sure parsing errors are caught and reported accordingly.

[Teeed]

Hi,

It looks like after bad install I got some invalid AID in the app list. Unfortunately, that makes gp tool to do not want to do anything more with the card. It always exists with the message Invalid argument: AID must be between 5 and 16 bytes: 0

Expected behavior

Should list and/or allow deletion of invalid entries.

Full log

Re-run your command with -d -v -i switches and:

# gp -l -d -v -i
# GlobalPlatformPro v24.10.15-22-gd9620f9
# Running on Linux 6.16.1-arch1-1 amd64, Java 21.0.8 by Arch Linux
[DEBUG] TerminalManager - Processing 1 readers with null as preferred and null as ignored
# SCardConnect("OMNIKEY AG 3121 USB 00 00", T=*) -> T=1, 3B9495810146545601C4
# SCardBeginTransaction("OMNIKEY AG 3121 USB 00 00")
A>> T=1 (4+0000) 00A40400 00 
A<< (0018+2) (30ms) 6F108408A000000003000000A5049F6501FF 9000
[DEBUG] GPSession - Auto-detected ISD: A000000003000000
A>> T=1 (4+0000) 80CA9F7F 00 
A<< (0045+2) (18ms) 9F7F2A4790050382116351030283190472820745664E3050383436454456313034373238321600012346500745 9000
[WARN] GPData - Invalid CPLC date: 4544
CPLC: ICFabricator=4790
      ICType=0503
      OperatingSystemID=8211
      OperatingSystemReleaseDate=6351 (2016-12-16)
      OperatingSystemReleaseLevel=0302
      ICFabricationDate=8319 (2018-11-15)
      ICSerialNumber=04728207
      ICBatchIdentifier=4566
      ICModuleFabricator=4E30
      ICModulePackagingDate=5038 (2025-02-07)
      ICCManufacturer=3436
      ICEmbeddingDate=4544 (invalid date format)
      ICPrePersonalizer=5631
      ICPrePersonalizationEquipmentDate=3034 (2023-02-03)
      ICPrePersonalizationEquipmentID=37323832
      ICPersonalizer=1600
      ICPersonalizationDate=0123 (2020-05-02)
      ICPersonalizationEquipmentID=46500745

A>> T=1 (4+0000) 80CA0042 00 
A<< (0003+2) (14ms) 420100 9000
IIN: 420100
A>> T=1 (4+0000) 80CA0045 00 
A<< (0010+2) (15ms) 45080000000000000000 9000
CIN: 45080000000000000000
A>> T=1 (4+0000) 80CA00CF 00 
A<< (0012+2) (16ms) CF0A00008319047282074566 9000
KDD: CF0A00008319047282074566
A>> T=1 (4+0000) 80CA00C1 00 
A<< (0004+2) (14ms) C10200EB 9000
SSC: C10200EB
Card Data: 
A>> T=1 (4+0000) 80CA0066 00 
A<< (0065+2) (19ms) 663F733D06072A864886FC6B01600C060A2A864886FC6B02020101630906072A864886FC6B03640B06092A864886FC6B040255660C060A2B060104012A026E0102 9000
Tag 6: 1.2.840.114283.1
-> Global Platform card
Tag 60: 1.2.840.114283.2.2.1.1
-> GP Version: 2.1.1
Tag 63: 1.2.840.114283.3
-> GP card is uniquely identified by the Issuer Identification Number (IIN) and Card Image Number (CIN)
Tag 6: 1.2.840.114283.4.2.85
-> GP SCP02 (i=55)
Tag 66: 1.3.6.1.4.1.42.2.110.1.2
-> JavaCard v2
Card Capabilities: 
A>> T=1 (4+0000) 80CA0067 00 
A<< (0060+2) (18ms) 673A6738A006800102810155A00A8001038102001082010781039EFE8082031E03008301028504010208408602040887040102084088050102030405 9000
[WARN] GPData - Bogus data detected, fixing double tag
Supports SCP02 i=55
Supports SCP03 i=00 i=10 with AES-128 AES-196 AES-256
Supported DOM privileges: SecurityDomain, CardLock, CardTerminate, CardReset, CVMManagement, TrustedPath, AuthorizedManagement, TokenVerification, GlobalDelete, GlobalLock, GlobalRegistry, FinalApplication, ReceiptGeneration
Supported APP privileges: CardLock, CardTerminate, CardReset, CVMManagement, FinalApplication, GlobalService
Supported LFDB hash: SHA-256
Supported Token Verification ciphers: RSA1024_SHA1, ECCP521_SHA512
Supported Receipt Generation ciphers: DES_MAC
Supported DAP Verification ciphers: RSA1024_SHA1, ECCP521_SHA512
Supported ECC Key Parameters: 0102030405
A>> T=1 (4+0000) 80CA00E0 00 
A<< (0020+2) (20ms) E012C00401FF8010C00402FF8010C00403FF8010 9000
Version: 255 (0xFF) ID:   1 (0x01) type: DES3         length:  16 (factory key)
Version: 255 (0xFF) ID:   2 (0x02) type: DES3         length:  16 (factory key)
Version: 255 (0xFF) ID:   3 (0x03) type: DES3         length:  16 (factory key)

# Warning: no keys given, defaulting to 404142434445464748494A4B4C4D4E4F
[INFO] GPSession - Using card master key(s) with version 0 for setting up session with MAC 
A>> T=1 (4+0008) 80500000 08 D3E6212EFCFFFFD7 00
A<< (0028+2) (57ms) 00008319047282074566FF0200EB5D8EA20C5908BFAFEE329E855DA0 9000
[DEBUG] GPSession - KDD: 00008319047282074566
[DEBUG] GPSession - SSC: 00EB
[DEBUG] GPSession - Host challenge: D3E6212EFCFFFFD7
[DEBUG] GPSession - Card challenge: 00EB5D8EA20C5908
[DEBUG] GPSession - Card reports SCP02 with key version 255 (0xFF)
[INFO] GPSession - Diversified card keys: ENC=404142434445464748494A4B4C4D4E4F (KCV: 8BAF47) MAC=404142434445464748494A4B4C4D4E4F (KCV: 8BAF47) DEK=404142434445464748494A4B4C4D4E4F (KCV: 8BAF47) for SCP02
[INFO] GPSession - Session keys: ENC=1ACEDB71EC960516B0429B1FCF74674F MAC=A294E0D63568E2CFC91C600CF30A5CF1 RMAC=4A14AA1F5738AD4A835C700F1EA62C6A
[DEBUG] GPSession - Verified card cryptogram: BFAFEE329E855DA0
[DEBUG] GPSession - Calculated host cryptogram: 544ABC5E9707F261
A>> T=1 (4+0016) 84820100 10 544ABC5E9707F261A89BA13D8CFB06B9 00
A<< (0000+2) (36ms) 9000
A>> T=1 (4+0010) 84F28002 0A 4F001AF1530C05F73222 00
A<< (0037+2) (31ms) E3234F08A0000000030000009F700101C5039EFE80C400CE020000CC08A000000003000000 9000
Invalid argument: AID must be between 5 and 16 bytes: 0
# SCardEndTransaction("OMNIKEY AG 3121 USB 00 00")
# SCardDisconnect("OMNIKEY AG 3121 USB 00 00", false) tx:97/rx:326 in 418ms

[martinpaljak]

Hi @Teeed

Two questions:

• what applet and how did you install before, as you said it worked before it? Do you have a trace of that install session?
• where did you source the card from?

This is my original JCOP3 SECID:
(tag C4 is present and with relevant data)

[TRACE] GPRegistry - [e3]
[TRACE] GPRegistry -      [4f] a000000151000000
[TRACE] GPRegistry -      [9f70] 01
[TRACE] GPRegistry -      [c5] 9efe80
[TRACE] GPRegistry -      [c4] a0000000620001
[TRACE] GPRegistry -      [ce] 0100
[TRACE] GPRegistry -      [cc] a000000151000000

This is yours:
(as you can see, tag C4 is present, but with zero length)

[TRACE] GPRegistry - [e3]
[TRACE] GPRegistry -      [4f] a000000003000000
[TRACE] GPRegistry -      [9f70] 01
[TRACE] GPRegistry -      [c5] 9efe80
[TRACE] GPRegistry -      [c4] 
[TRACE] GPRegistry -      [ce] 0000
[TRACE] GPRegistry -      [cc] a000000003000000

[Teeed]

Applet was installed using contactless interface, and it seems like something went very wrong during install (seems like maybe there was not enough power and install got damaged?). I have used this particular card a lot and it was functioning good before (but I was using contact reader).
I have performed install of this applet (during which everything went wrong) using standard contact reader (OMNIKEY AG 3121) on another (the same card's model, the same batch etc.) and everything went well, and applet is fully functioning.
Only issue is that I can not "recover" this "broken" card using GPP tool.

[martinpaljak]

You can try applying the 6 line fix from the copilot created PR (surprisingly the final variant is 80% match on what I wrote myself) but I'm more interested in how and why you got to the weird state, and why installing a random applet affects the status report for the ISD, which makes zero sense. It is a somewhat fragile card, but not in this way, before.

GlobalPlatformPro/library/src/main/java/pro/javacard/gp/GPRegistry.java

Lines 202 to 207 in 16337d0

	byte[] loadfileBytes = loadfiletag.getBytesValue();
	if (loadfileBytes.length > 0) {
	e.setLoadFile(new AID(loadfileBytes));
	} else {
	logger.warn("Skipping invalid load file AID (length: {})", loadfileBytes.length);
	}

There are also rumours of look-alikes being sold on aliexpress (and your variant being explicitly configured to look like an "older" card judging from the ISD AID) so in addition to making the fix for the specific issue of a bogus card, I'd really like to know more about a) the applet you tried to install (AID-s, content) b) source for card. It is OK to not share neither, of course, but right now I'd like to understand how you reached this state.

The patch will fix this issue, but I'm curious to see what the card content would look like with this patch applied (vs another card from the same batch). Please send this via e-mail if possible (unless you want to post it here)

[Teeed]

Hi,

Ahhh, here are some details: this card is some NXP J3H145 (ATR 3B9495810146545601C4) which I've bought through some friends loooong time ago (around 2019). We bought a whole batch of them, and we did not have any issues with them. The applet was IsoApplet (https://github.com/philipWendland/IsoApplet).
For contact reader I am using OMNIKEY AG 3121 USB and for contactless OMNIKEY 5023 CL.

./IsoApplet.cap 
CAP file (v2.1), contains: applets for JavaCard 3.0.4
Package: xyz.wendland.javacard.pki.isoapplet F276A288BCFBA69D34F310 v1.0
Applet:  xyz.wendland.javacard.pki.isoapplet.IsoApplet F276A288BCFBA69D34F31001
Import:  A0000000620001                   v1.0 java.lang
Import:  A0000000620101                   v1.5 javacard.framework
Import:  A0000000620209                   v1.0 javacardx.apdu
Import:  A0000000620102                   v1.5 javacard.security
Import:  A0000000620201                   v1.5 javacardx.crypto
Generated by Oracle Corporation converter  [v3.1.0]
On Sun Aug 24 20:28:03 UTC 2025 with JDK 17.0.16 (Eclipse Adoptium)
Code size 11912 bytes (14136 with debug)
SHA-256 9b55c53aec78ccf4b22472b4f0f9ba0eaf4b8ed67566ec96755eb8d3b30e3c4c
SHA-1   592a46bc3144f61deb1893912db33ed2fdb2d22c

I'll try this patch and see how it goes :)

[Teeed]

Ok, after quick patch listing worked:

$ java -jar ./GlobalPlatformPro/tool/target/gp.jar -l --verbose
# gp -l --verbose
# GlobalPlatformPro v24.10.15-22-gd9620f9-dirty
# Running on Linux 6.16.1-arch1-1 amd64, Java 21.0.8 by Arch Linux
# Warning: no keys given, defaulting to 404142434445464748494A4B4C4D4E4F
[INFO] GPSession - Using card master key(s) with version 0 for setting up session with MAC 
[INFO] GPSession - Diversified card keys: ENC=404142434445464748494A4B4C4D4E4F (KCV: 8BAF47) MAC=404142434445464748494A4B4C4D4E4F (KCV: 8BAF47) DEK=404142434445464748494A4B4C4D4E4F (KCV: 8BAF47) for SCP02
[INFO] GPSession - Session keys: ENC=E397C0EE3C6A02D47A9267DD19663A13 MAC=15F696262B2C8F5E96F551D880D648B4 RMAC=013794A9D3669D5331D12724ED4CF14E
ISD: A000000003000000 (OP_READY)
     Parent:   A000000003000000
     From:     A0000000620001
     Privs:    SecurityDomain, CardLock, CardTerminate, CardReset, CVMManagement, TrustedPath, AuthorizedManagement, TokenVerification, GlobalDelete, GlobalLock, GlobalRegistry, FinalApplication, ReceiptGeneration

PKG: A0000001515350 (LOADED) (SSD creation package)
     Applet:   A000000151535041 (SSD creation applet)

Tried reinstalling the app

$ java -jar ./GlobalPlatformPro/tool/target/gp.jar --install ./IsoApplet.cap 
# Warning: no keys given, defaulting to 404142434445464748494A4B4C4D4E4F
[WARN] GPRegistry - Skipping invalid load file AID (length: 0)
Error: SCARD_E_NOT_TRANSACTED
Exception when ending card transaction: SCardEndTransaction got response 0x80100069 (SCARD_W_REMOVED_CARD: The smart card has been removed, so further communication is not possible.)

And the card got totally bricked.

$ java -jar ./GlobalPlatformPro/tool/target/gp.jar -l --verbose
# gp -l --verbose
# GlobalPlatformPro v24.10.15-22-gd9620f9-dirty
# Running on Linux 6.16.1-arch1-1 amd64, Java 21.0.8 by Arch Linux
[WARN] TerminalManager - Unpowered card. Contact card inserted wrong way or card mute?
Error: SCardConnect got response 0x80100067 (SCARD_W_UNPOWERED_CARD: Power has been removed from the smart card, so that further communication is not possible.)

After a while I got some responses from the card, retried this whole thing, and it went to being broken (again). After laying flat unpowered for a 3mins it went back to "life" again. Tried freezing/applying heat - no change. Maybe memory is just dead and acting up? If you want to try something else (even destructible) I am on it - this card is dead to me.

Thanks for trying to help! :)

[martinpaljak]

always use -d to get the actual apdu trace. Looking at the output, the fix is not needed, as the relevant thing is reported nicely. So a dead/bogus card, the real issue here is providing "better" error messages of what is failing and why (right now the runtime type exception bubbled out of parsing)

ISD: A000000003000000 (OP_READY)
Parent: A000000003000000
From: A0000000620001
Privs: SecurityDomain, CardLock, CardTerminate, CardReset, CVMManagement, TrustedPath, AuthorizedManagement, TokenVerification, GlobalDelete, GlobalLock, GlobalRegistry, FinalApplication, ReceiptGeneration

[Teeed]

$ java -jar ./GlobalPlatformPro/tool/target/gp.jar -l  -v -d
# gp -l -v -d
# GlobalPlatformPro v24.10.15-22-gd9620f9-dirty
# Running on Linux 6.16.1-arch1-1 amd64, Java 21.0.8 by Arch Linux
[DEBUG] TerminalManager - Processing 1 readers with null as preferred and null as ignored
# SCardConnect("OMNIKEY AG 3121 USB 00 00", T=*) -> T=1, 3B9495810146545601C4
# SCardBeginTransaction("OMNIKEY AG 3121 USB 00 00")
A>> T=1 (4+0000) 00A40400 00 
A<< (0018+2) (33ms) 6F108408A000000003000000A5049F6501FF 9000
[DEBUG] GPSession - Auto-detected ISD: A000000003000000
# Warning: no keys given, defaulting to 404142434445464748494A4B4C4D4E4F
[INFO] GPSession - Using card master key(s) with version 0 for setting up session with MAC 
A>> T=1 (4+0008) 80500000 08 489BF03D8C896CBF 00
A<< (0028+2) (57ms) 00008319047282074566FF020105166271A48D166857AFC983B5B334 9000
[DEBUG] GPSession - KDD: 00008319047282074566
[DEBUG] GPSession - SSC: 0105
[DEBUG] GPSession - Host challenge: 489BF03D8C896CBF
[DEBUG] GPSession - Card challenge: 0105166271A48D16
[DEBUG] GPSession - Card reports SCP02 with key version 255 (0xFF)
[INFO] GPSession - Diversified card keys: ENC=404142434445464748494A4B4C4D4E4F (KCV: 8BAF47) MAC=404142434445464748494A4B4C4D4E4F (KCV: 8BAF47) DEK=404142434445464748494A4B4C4D4E4F (KCV: 8BAF47) for SCP02
[INFO] GPSession - Session keys: ENC=20C620FFE32BD90A07B8A14AD107275A MAC=A376BA3140DD65A44D7ED5BB9034D3A5 RMAC=2974DD7CB6F81D9795EB99CF4E8F2C8A
[DEBUG] GPSession - Verified card cryptogram: 6857AFC983B5B334
[DEBUG] GPSession - Calculated host cryptogram: FA984FACEBD916F4
A>> T=1 (4+0016) 84820100 10 FA984FACEBD916F4F9E7F0DBE7155EBD 00
A<< (0000+2) (36ms) 9000
A>> T=1 (4+0010) 84F28002 0A 4F00FF047B02C051A74D 00
A<< (0037+2) (31ms) E3234F08A0000000030000009F700101C5039EFE80C400CE020000CC08A000000003000000 9000
[WARN] GPRegistry - Skipping invalid load file AID (length: 0)
A>> T=1 (4+0010) 84F24002 0A 4F00736E9F51D41192D0 00
A<< (0000+2) (28ms) 6A88
A>> T=1 (4+0010) 84F21002 0A 4F00E9959073E3793789 00
A<< (0025+2) (30ms) E3174F07A00000015153509F7001018408A000000151535041 9000
A>> T=1 (4+0010) 84F22002 0A 4F0082201021B57023FC 00
A<< (0015+2) (30ms) E30D4F07A00000015153509F700101 9000
ISD: A000000003000000 (OP_READY)
     Parent:   A000000003000000
     Privs:    SecurityDomain, CardLock, CardTerminate, CardReset, CVMManagement, TrustedPath, AuthorizedManagement, TokenVerification, GlobalDelete, GlobalLock, GlobalRegistry, FinalApplication, ReceiptGeneration

PKG: A0000001515350 (LOADED) (SSD creation package)
     Applet:   A000000151535041 (SSD creation applet)

# SCardEndTransaction("OMNIKEY AG 3121 USB 00 00")
# SCardDisconnect("OMNIKEY AG 3121 USB 00 00", false) tx:105/rx:137 in 341ms

$ java -jar ./GlobalPlatformPro/tool/target/gp.jar --install ./IsoApplet.cap -v -d
# gp --install ./IsoApplet.cap -v -d
# GlobalPlatformPro v24.10.15-22-gd9620f9-dirty
# Running on Linux 6.16.1-arch1-1 amd64, Java 21.0.8 by Arch Linux
[DEBUG] TerminalManager - Processing 1 readers with null as preferred and null as ignored
# SCardConnect("OMNIKEY AG 3121 USB 00 00", T=*) -> T=1, 3B9495810146545601C4
# SCardBeginTransaction("OMNIKEY AG 3121 USB 00 00")
A>> T=1 (4+0000) 00A40400 00 
A<< (0018+2) (30ms) 6F108408A000000003000000A5049F6501FF 9000
[DEBUG] GPSession - Auto-detected ISD: A000000003000000
# Warning: no keys given, defaulting to 404142434445464748494A4B4C4D4E4F
[INFO] GPSession - Using card master key(s) with version 0 for setting up session with MAC 
A>> T=1 (4+0008) 80500000 08 5C886A8E59AC4EAD 00
A<< (0028+2) (57ms) 00008319047282074566FF0201088AD59B1E7EBD9FE7820EC0611925 9000
[DEBUG] GPSession - KDD: 00008319047282074566
[DEBUG] GPSession - SSC: 0108
[DEBUG] GPSession - Host challenge: 5C886A8E59AC4EAD
[DEBUG] GPSession - Card challenge: 01088AD59B1E7EBD
[DEBUG] GPSession - Card reports SCP02 with key version 255 (0xFF)
[INFO] GPSession - Diversified card keys: ENC=404142434445464748494A4B4C4D4E4F (KCV: 8BAF47) MAC=404142434445464748494A4B4C4D4E4F (KCV: 8BAF47) DEK=404142434445464748494A4B4C4D4E4F (KCV: 8BAF47) for SCP02
[INFO] GPSession - Session keys: ENC=1328F28AC96640901389754D71473907 MAC=B2B1823630B769F19B16B946DCFFCDE8 RMAC=13EE4D0DADA7ABBC86E5F9E68F62E6FF
[DEBUG] GPSession - Verified card cryptogram: 9FE7820EC0611925
[DEBUG] GPSession - Calculated host cryptogram: 6F938637268A9762
A>> T=1 (4+0016) 84820100 10 6F938637268A976234B14D5680C64DF9 00
A<< (0000+2) (36ms) 9000
A>> T=1 (4+0010) 84F28002 0A 4F002C9A38FFE03117D2 00
A<< (0037+2) (31ms) E3234F08A0000000030000009F700101C5039EFE80C400CE020000CC08A000000003000000 9000
[WARN] GPRegistry - Skipping invalid load file AID (length: 0)
A>> T=1 (4+0010) 84F24002 0A 4F00996C54F2F73E74E5 00
A<< (0000+2) (29ms) 6A88
A>> T=1 (4+0010) 84F21002 0A 4F0087B1D5CDA47945E2 00
A<< (0025+2) (30ms) E3174F07A00000015153509F7001018408A000000151535041 9000
A>> T=1 (4+0010) 84F22002 0A 4F00495FFFB8BE2C02EF 00
A<< (0015+2) (29ms) E30D4F07A00000015153509F700101 9000
CAP file (v2.1), contains: applets for JavaCard 3.0.4
Package: xyz.wendland.javacard.pki.isoapplet F276A288BCFBA69D34F310 v1.0
Applet:  xyz.wendland.javacard.pki.isoapplet.IsoApplet F276A288BCFBA69D34F31001
Import:  A0000000620001                   v1.0 java.lang
Import:  A0000000620101                   v1.5 javacard.framework
Import:  A0000000620209                   v1.0 javacardx.apdu
Import:  A0000000620102                   v1.5 javacard.security
Import:  A0000000620201                   v1.5 javacardx.crypto
Generated by Oracle Corporation converter  [v3.1.0]
On Sun Aug 24 20:28:03 UTC 2025 with JDK 17.0.16 (Eclipse Adoptium)
Code size 11912 bytes (14136 with debug)
SHA-256 9b55c53aec78ccf4b22472b4f0f9ba0eaf4b8ed67566ec96755eb8d3b30e3c4c
SHA-1   592a46bc3144f61deb1893912db33ed2fdb2d22c
A>> T=1 (4+0032) 84E60200 20 0BF276A288BCFBA69D34F31008A0000000030000000000001F85F8213B53B6EB 00
A<< (0001+2) (41ms) 00 9000
A>> T=1 (4+0255) 84E80000 FF C4822E88010015DECAFFED01020400010BF276A288BCFBA69D34F31002001F0015001F00100033031600FF2534000A04A3000008AD00060000000005010004003305000107A0000000620001050107A0000000620101000107A0000000620209050107A0000000620102050107A0000000620201030010010CF276A288BCFBA69D34F3100106C30600FF0080000400020105000101B101E20226022B0230023600000001FF00060101000249000016020001070300010288028D02B0026100002201FF000803010002D602B002D100003401FF0008030100031002B002D10000160100010701000103740357000000020001060B00010347AF82E1B94C09F4 00
<< (6s797ms) SCARD_E_NOT_TRANSACTED
[DEBUG] CardBIBO - Assuming tag removed, because SCARD_E_NOT_TRANSACTED
Error: SCARD_E_NOT_TRANSACTED
# SCardEndTransaction("OMNIKEY AG 3121 USB 00 00")
# SCardDisconnect("OMNIKEY AG 3121 USB 00 00", false) tx:143/rx:140 in 7s208ms

$ java -jar ./GlobalPlatformPro/tool/target/gp.jar -l  -v -d
# gp -l -v -d
# GlobalPlatformPro v24.10.15-22-gd9620f9-dirty
# Running on Linux 6.16.1-arch1-1 amd64, Java 21.0.8 by Arch Linux
[WARN] TerminalManager - Unpowered card. Contact card inserted wrong way or card mute?
[DEBUG] TerminalManager - Processing 1 readers with null as preferred and null as ignored
# SCardConnect("OMNIKEY AG 3121 USB 00 00", T=*) -> SCARD_W_UNPOWERED_CARD
Error: SCardConnect got response 0x80100067 (SCARD_W_UNPOWERED_CARD: Power has been removed from the smart card, so that further communication is not possible.)