APDU Response Debugger

APDU Response Debugging

Smart card communication uses Application Protocol Data Units (APDUs) as defined in ISO/IEC 7816-4. The response APDU consists of an optional data body followed by a mandatory 2-byte status word (SW1 SW2). Understanding status words is critical for debugging card application issues.

Common Status Words

The most common status word is 9000 (success). 61XX means the card has XX bytes of data available (retrieve with GET RESPONSE). 6XXX indicates warnings or errors: 6A82 (file not found), 6982 (security status not satisfied - usually means PIN not verified), 6985 (command not allowed - conditions not met), 6D00 (instruction not supported), 6E00 (class not supported), 6400 (execution error). 63CX indicates PIN verification failed with X remaining attempts. 6CXX means Le (expected length) was wrong; the correct length is XX.

Debugging Strategy

When debugging APDU failures, first check the status word. 6982 usually means you need to verify a PIN before accessing the file. 6A82 means the file ID or AID is wrong. 6985 may indicate the command sequence is incorrect (e.g., trying to write without selecting first). 6100 means the response data is longer than the Le you provided; issue GET RESPONSE (C0 00 00 ) to fetch remaining bytes. For security-related errors, verify that your SCP session is properly established and the correct key set is being used. Use our APDU Builder to construct commands and APDU Reference for a complete command list.

Status Word Categories and Ranges

ISO 7816-4 defines a systematic status word classification. SW1 in the 0x90 range (only 9000) means successful execution. SW1 in the 0x61 range means the command succeeded but more data is available — always follow with GET RESPONSE. SW1 in the 0x62-0x63 range indicates warnings: the state is non-volatile-memory-changed or unchanged depending on the exact SW1. SW1 0x63 specifically indicates a counter-based warning (PIN tries, key tries). SW1 0x64-0x65 indicates execution errors (non-volatile memory unchanged or changed). SW1 0x67-0x6E indicates various error conditions: 6700 wrong length, 6881 logical channel not supported, 6982 security not satisfied, 6A82 file not found, 6D00 INS not supported, 6E00 CLA not supported. SW1 0x6F00 is a catch-all "no precise diagnosis."

Chaining and GET RESPONSE Protocol

When a card response returns 61 XX, it means the card has XX more bytes of data that did not fit in the original response. The terminal must send a GET RESPONSE command (00 C0 00 00 XX) to retrieve them. This can chain multiple times — each GET RESPONSE may itself return 61 YY for more data. This mechanism handles cases where the response data exceeds the terminal's IFSC (Information Field Size for Card contact) or the negotiated frame size. In T=CL (contactless) protocol, the card may also use chaining at the ISO 14443-4 layer (I-Block chaining), which the terminal's NFC stack handles transparently — but at the APDU layer you still see 61XX if the application layer data is too large.

Security-Related Status Words in Practice

The 69 82 "security status not satisfied" error is the most common APDU error in smart card development. It means the card requires a prior authentication step that was not completed. For GlobalPlatform, this usually means the secure channel (SCP02/SCP03) is not established — verify that you sent INITIALIZE UPDATE and EXTERNAL AUTHENTICATE before attempting operations. For file access, it may mean a PIN was not verified (VERIFY command with the correct PIN reference needed). The 69 85 "conditions of use not satisfied" is subtler — it often means the application lifecycle state prevents the operation (e.g., trying to personalize a card that is in operational state, or trying to read a file that is in LOCKED state). For 63 CX, always log the remaining try counter and alert the user — after the counter reaches zero, the PIN or key is permanently blocked and may require a PUK or administrative unblock procedure.

GlobalPlatform-Specific Status Words

GlobalPlatform defines additional status word meanings beyond ISO 7816. 6283 in GP context means "Application is permanently locked." 6581 means "memory failure" — often a sign of EEPROM wear-out or flash write failure. 6A86 during INSTALL command often means the make-SELECTable parameters are malformed. When debugging GP commands, cross-reference the status word with the GP Card Specification document, not just ISO 7816, because GP overlays additional semantics. Also note that some card vendors use proprietary SW values (e.g., NXP JCOP cards may return 6480 for specific Java Card exceptions), so consult the card's reference manual when the standard lookup yields no match.