The communication protocol of the Legic RFID module is subject to secrecy. Therefore, only the command for capturing the UID is described here so that you can check the functionality of the RFID device. 



The Legic command SEARCH_TXP is correct to capture the UID.


0x04 01 02 CRC_H CRC_L will look out for an ISO 14443A transponder

0x04 = Length of bytes to follow
0x01 = Command code
0x02 = Transponder type, ISO 14443A
CRC_H = 0x00 allowed as test value
CRC_L = 0x00 allowed as test value

Transponder types:
0x00 = LEGIC RF standard
0x01 = ISO 15693
0x02 = ISO 14443 A
0x03 = ISO 14443 B
0x04 = INSIDE Secure
0x05 = SONY FeliCa subset

…

The checksum is according to the description of the communication protocol CRC-CCITT (CRC-16) with this generator polynomial x^16 + x^12 + x^5 + 1 and the start value 0xFFFF, Big Endian, Reversed 0x8408.

But according to the documentation it is allowed to simply send 0x0000.

Online calculation: http://crccalc.com => CRC-16/MCRF4XX

…

Examples with correct CRC:

04 01 00 43 8A = SEARCH_TXP for Legic
04 01 01 52 03 = SEARCH_TXP for ISO 15693 (I-Code SLI, μD, etc.)
04 01 02 60 98 = SEARCH_TXP for ISO 14443 A (Mifare, Ultralight, etc.)
04 01 03 71 11 = SEARCH_TXP for ISO 14443 B
04 01 04 05 AE = SEARCH_TXP for INSIDE Secure
04 01 05 14 27 = SEARCH_TXP for SONY FeliCa subset

…

Example code for CRC calculation:

unsigned int CRC16(unsigned char * p, int n)
{
int i;
int k;
unsigned int polynom = 0x8408; // CCITT
unsigned int crc = 0xFFFF; // inital value
for (i = 0; i < n; i++)
{
crc ^= p[i];
for (k = 0; k < 8; k++)
{
if (crc & 1) crc = (crc >> 1) ^ polynom;
else crc = crc >> 1;
}
}
return crc;
}



