Database Info

[Q] NFC Card Emulation Question Thread

Hi all,
My question is one that has been asked a few times around here, but never answered in a very satisfying way:
Is NFC card emulation possible for app development?
I've done days of research on this, and I have yet to encounter any decent summary thread explaining clearly the current state of affairs on this particular subject. Therefore, I'm starting this thread to gather all the information I've been able to find into one place and hopefully get some help filling in the gaps in my understanding of the subject.
What I think I know:
- NFC Card emulation can be done one of two ways:
1) In hardware, using the secure element.
This way seems like the hard way.
h t t p://nelenkov.blogspot.com/2012/08/android-secure-element-execution.html <-- This article talks about the process of accessing the secure element in great detail for ICS on the Galaxy Nexus.
The secure element can emulate Mifare Classic cards, JavaCard formatted cards, EMV credit cards, and ISO 14333A/B formatted cards in general. Google Wallet is the premiere example of an app that utilizes this emulation method. Access to the secure element is difficult, but possible.​
2) In software, using a virtual smartcard independent of the secure element
This is not a method built into standard Android ROMs, but has been supported in Cyanogenmod since version 9.1. Again, h t t p://nelenkov.blogspot.com/2012/10/emulating-pki-smart-card-with-cm91.html <-- this blog explains in detail. This method is only capable of emulating EMV cards. NFCProxy and SimplyTapp are the premiere examples of apps that utilize software card emulation​
What I've had trouble finding is API documentation and practical examples of any kind. Several people have claimed, as in threads like this: http://forum.xda-developers.com/showthread.php?t=1706057&page=7 , that they have emulated MIFARE cards on their phone, but details are scarce.
What I'd like to know:
- Are there any APIs available for writing to the secure element, official or otherwise.
- Is there any way to perform raw reads and writes to/from the NFC module, (to replicate raw card information, for instance)
- What protocols are actually supported, both in secure element and software? For instance, what is the state of FeliCa emulation?
If anyone out there knows the answers to these questions, or can provide any further insight, please share it below.
Thanks!

Hi,
Timuu-kun said:
Is NFC card emulation possible for app development?
Click to expand...
Click to collapse
Yes, but with many limitations.
Timuu-kun said:
The secure element can emulate Mifare Classic cards, JavaCard formatted cards, EMV credit cards, and ISO 14333A/B formatted cards in general.
Click to expand...
Click to collapse
There are different types of secure elements. E.g. a phone may have an embedded secure element (a chip soldered into the phone), an NFC UICC (a SIM card that acts as a secure element) and a removable secure element in another form factor (e.g. MicroSD card). More than one of these secure elements may coexist in one device.
Some secure elements (e.g. NXP's SmartMX) can emulate MIFARE Classic. In general secure elements use standard smartcard communication protocols. Thus, they can be accessed using APDUs (as defined in ISO/IEC 7816-4).
Most (or all?) secure elements are based on JavaCard technology. Note that this is not a format, but a specification of the execution environment for applications. I.e. JavaCard defines a Java-based API and a Java virtual machine that runs Java applications (called applets) in JavaCard byte code.
Thus any application that runs on a secure element is a JavaCard application. For instance if a bank implements an EMV compliant credit card to be used on a secure element, this credit card applet would be a JavaCard application. Similarly, whenever you want the secure element to process APDU commands, you would create just another JavaCard application to handle your APDU commands.
Typically in Japan you may also find secure elements that emulate FeliCa (though I have not seen any of them yet).
Regarding ISO/IEC 14443: This is the contactless communication protocol used by smartcards/by the secure element (except for FeliCa which uses a different communication protocol). The different layers of ISO/IEC 14443 define modulation, coding, anti-collision (i.e. enumeration of cards if multiple cards are visible to a reader), selection, framing and a transport protocol. For layers below the transport protocol, ISO/IEC 14443 is split into two different protocols: Type A and Type B. Not all smartcards/NFC tags support all protocol layers.
For instance MIFARE Ultralight uses a proprietary protocol on top of the framing protocol of ISO/IEC 14443-3 Type A. MIFARE Classic also uses a proprietary protocol on top of ISO/IEC 14443-3 Type A (though it uses a slightly different framing).
A smartcard that uses ISO/IEC 7816-4 APDUs over the contactless interface (i.e. a typical secure element), exchanges these APDUs on top of the transport protocol defined in ISO/IEC 14443-4. This transport protocol is the same for ISO/IEC14443 Type A and Type B. Thus, secure elements can use either ISO/IEC14443 Type A or Type B. A secure element that emulates MIFARE Classic will use Type A, as MIFARE Classic is (partly) based on that protocol.
Timuu-kun said:
[Software card emulation] is only capable of emulating EMV cards.
Click to expand...
Click to collapse
Software card emulation (or host card emulation) using NXP's NFC controller PN544 (or its successor PN547) can only "cards" using the transport protocol of ISO/IEC 14443-4 (e.g. no FeliCa, no ISO/IEC 15693). (Either as a Tpye A or as a Type B "card".) Thus, no proprietary protocols below that transport protocol can be emulated (e.g. no MIFARE Classic, no MIFARE Ultralight). Also the UID (unique identifier) used during the anti-collision phase will be a new random value for every activation through a contactless reader.
So you could emulate an EMV payment card (but you are not limited to EMV).
Unfortunately, the only manufacturer of NFC controller chipsets that was willing to provide me datasheets & user manuals of their NFC controllers was NXP (and even they release them only under a strict NDA). Broadcom and others were not willing to share such information with academic institutions. Thus, I have no information on the software card emulation capabilities of other NFC controllers.
Timuu-kun said:
Are there any APIs available for writing [better: access] to the secure element, official or otherwise.
Click to expand...
Click to collapse
For Android:
Embedded secure element on Android devices:
com.android.nfc_extras
This API is available at least on Google's Nexus devices and Samsung Galaxy S3.
Nikolay explains how to use that API: http://nelenkov.blogspot.nl/2012/08/accessing-embedded-secure-element-in.html. You can also browse the source code in AOSP: https://android.googlesource.com/platform/frameworks/base/+/master/nfc-extras/
UICC based secure elements and virtually any other type of secure element including embedded secure elements:
SEEK-for-Android (based on simalliance's standardized Open Mobile API)
This API is available at least in Samsung Galaxy S3, Samsung Galaxy S2 NFC, Sony Xperia S, though all three devices implement only access to the UICC through this API.
You can find details on this API here: http://code.google.com/p/seek-for-android/
Software card emulation:
Doug Yeager's extensions to the Android NFC API
These API extensions are available on CyanogenMod since 9.1 and will soon be integrated into our SuperSmile ROM. The current implementation will only work with NXP's NFC controller chipset.
Timuu-kun said:
Is there any way to perform raw reads and writes to/from the NFC module, (to replicate raw card information, for instance)
Click to expand...
Click to collapse
I'm not quite sure what you are trying to achive here.
Timuu-kun said:
What protocols are actually supported, both in secure element and software? For instance, what is the state of FeliCa emulation?
Click to expand...
Click to collapse
See above.
Hope that sheds some light on the card emulation topic.
Best regards,
Michael

kennymccormic said:
I'm not quite sure what you are trying to achive here.
Click to expand...
Click to collapse
Hello!
As far as I can understand most of the people just want to do one simple thing:
Clone any type of nfc id card and use phone instead of it. They don't want to bother with standards, interfaces, etc.
Put card on the phone, "read" it. And later "play" it. If this is not possible there is no reason to discuss it further.

HCE tools
Hi guys, just want to do an update here. ST is releasing javacard tools for cloud based SE to be used starting out on CM, but hopefully soon in AOSP....we'll see.
We are releasing a few SDK's. there is no charge to use the SDK's or make your own cards at this time. just looking for experts on the board to use it and try out some of there own applications.
basically, the idea is simple. develop your own JavaCard / Global Platform application, or just recompile your original one from a hardware based SE using eclipse tools. then upload your applet to the cloud after you are done testing.
Then using OAuth consumer, you can consumer the applet from your CM application or any other payment type application for that matter. THe cloud SE gives you backend access to an HSM, but this is abstracted through GP/JavaCard.
To present to an NFC terminal, CM or other HCE based devices are required to pass the card APDU's through the phone to the handset.
we will continue to develop and support and update these tools going forward. at this point they are pretty sparse, but smart folks could get a jump on it without too much effort.
again, this is just away to extend the SE environment to those who can't afford to buy it from a telco. so we hope that people find lots of good ways to use the SE, cause it is available now to just about anyone who wants to learn and use it.
thx guys, there are tons of smart people who follow this forum. i'm amazed at how folks figure this sh** out on next to 0 docs...
oh yeah, see the developer section on simplytapp website, the wiki is starting and you can start playing with tools there. we need bug feedback too to build out help docs. we will try to fix bugs as quick as possible.
-doug

SE dev kit for HCE applications
ST is releasing a free development kit to build your own SE applications and host them off of the mobile device.
these apps can emulate existing cards like V/MC/AMEX/DIS cards or your own cards if you have a closed loop system.
please see simplytapp.com to get the stuff you need. release is end of october 25, 2013.
-doug

[email protected] said:
ST is releasing a free development kit to build your own SE applications and host them off of the mobile device.
these apps can emulate existing cards like V/MC/AMEX/DIS cards or your own cards if you have a closed loop system.
please see simplytapp.com to get the stuff you need. release is end of october 25, 2013.
-doug
Click to expand...
Click to collapse
Will this work on CM Androids, or is there any chance that Google will open up API?

Is there any chance to working NFC HCE on Nexus 4 (Android 4.4) outsite the US?

Vojtas.m said:
Is there any chance to working NFC HCE on Nexus 4 (Android 4.4) outsite the US?
Click to expand...
Click to collapse
The HCE API is not restricted to any region, so you can already use it outside the US.

I know, but Google Wallet is and I can't find any other application which can work with it.

I've seen some post here @xda that some users even with old SGS2 (nfc edition) use it to open doors and pay for transport. And claim is was android 2.3.x.
And now we are waiting for HCE, probably backported to 4.1-4.3. I don't undertand at all...

Any update to this with the latest release of KitKat and Lollipop with their HCE libraries? Interested in Mifare Ultralight emulating via HCE. The raw data is readable.

cryzies said:
Any update to this with the latest release of KitKat and Lollipop with their HCE libraries? Interested in Mifare Ultralight emulating via HCE. The raw data is readable.
Click to expand...
Click to collapse
The Android HCE API permits emulation of ISO/IEC 7816-4 application structures only (i.e. applications that use APDUs over ISO/IEC 14443-4 and that are explicitly selected using a SELECT (by AID/DF name) APDU). So you cannot emulate MIFARE Ultralight (or any other tag type that does not speak APDUs).

NFC Writable Tags for Nexus 5?

I want to experiment with NFC tags, but I have read there are some compatibility issues.
Has anyone purchased NFC tags that work with the N4? If so, what type should I be looking for, and where can they be purchased?
TIA.

I ordered these: http://www.ebay.com/itm/160923054515
Still have not received them (I guess in 2 weeks or something like that I will) so I don't know if they will work, but they should.

Ordered these and they work like a charm ! (you can find the stickers and hand tags separated) www (.) amazon (.) co (.) uk/RapidNFC-Tags-Task-Launcher-Pack/dp/B00A0Y97C8

Most tags will work, but the ones to stay away from are the Mifare Classic Tags - those only work with devices that have a specific manufacture's NFC Chip.
NTAG203 Tags are the most popular and affordable NFC tags for general use that also are universally compatible with all NFC devices. For uses requiring a little more memory, there are the Topaz 512 Tags.
We have both over at AndyTags.com (disclosure - it's my store) as well as NTAG203 key chains, but most NFC suppliers these days will have either type so no obligation to get them from us.

[APP][3.0+] UltraManager - Mifare Ultralight Manager

Hi everybody,
I recently finished working on a new app. It basically allows you to handle Mifare Ultralight tags.
Mifare Ultralight tags are inexpensive tags that are being used world-wide for a number of different tasks: public transportation, events, authentications and so on. The best thing about it (from my wicked point of view) is that it is not encrypted, which means that you can easily read/write those tags (as long as the contents of the tag can be overwritten).
As far as I know, there are some apps available for reading/writing tags, but most of them are either expensive or only allow you to write one word (32 bit) at a time, resulting in a long and boring process when you need to create a tag from scratch (i.e. writing 16 words on it), or editing multiple words.
This is why I came up with UltraManager. If you are in possess of Mifare Ultralight tags and you would like to find out more about their contents, this is the app you need.
At first I thought of only selling the app; but since the number of systems using Mifare Ultralight tags is getting higher as the time goes by, I wanted to allow as many people as possible to put their hands on those systems.
This is why I developed both a Lite and a Pro version. If you are only interested in doing some basic operations with your Mifare Ultralight tag, the Lite version will do just fine. There are no ads, and you will be able to read, edit and write tags.
If you find the app useful, or you need other features, there is a Pro version available as well: many other options are available for this version. The price for the Pro version is € 0.99 ($ 1.36).
The permissions required by both the Lite and the Pro apps are:
Network communication - control Near Field Communication
UltraManager Lite - Google Play
UltraManager Pro - Google Play
Any comment, suggestion and feedback is welcomed.
Thank you all,
Flavio 'darkjoker' Giobergia

Hey i want to try, can u fix the links, couldnt find with search at google play
Sent from my GT-I9500 using Tapatalk

Unfortunately I can't: I haven't sent 10 messages yet
Are you sure you can't find the app? Does your phone support NFC and your android version is >=3.0? Copy and paste the link from this topic, it works! It's only missing the starting "https://" !

Try this link for the apps:
https://play.google.com/store/apps/developer?id=Flavio+Giobergia

Diskb0x said:
Try this link for the apps:
https://play.google.com/store/apps/developer?id=Flavio+Giobergia
Click to expand...
Click to collapse
Thank you Diskb0x I'm turning 10 (posts) soon, in the meantime, thanks one again!

Version 1.1 released: Fixed a minor bug which did not allow tags to be read successfully from foreground dispatch (i.e. when a tag was found and the app was opened using the Activity Chooser, it was not recognized, so one had to scan the tag again to have it read).
The bug affected both the Lite and the Pro version.

Version 1.2.1 released: Some devices keep finding the tag every few seconds; this makes it uneasy to read/write it. This new version should fix the problem by waiting for a tag to be found before reading/writing, if no tag is found when the "Read"/"Write" button is pressed.
Plus, instead of a popup message appearing every time a new tag is found, the actionbar now turns green when a tag is available.

How can you read this tags with NFC or Camera (like QR)? I first time heared for this tags.

ivan123 said:
How can you read this tags with NFC or Camera (like QR)? I first time heared for this tags.
Click to expand...
Click to collapse
These tags can be read using the NFC technology: it is based on the induction of an electrical current in the tag (Maxwell's equations), while the QRs are basically 2-dimensional bar codes: the camera reads the black and white pixels and an app "knows" how to decode them.
The thing they have in common is that both NFC tags and QR codes can store information, and many devices can read them properly; the main difference is that, while a QR code can be read by everybody in possess of the QR code itself, the NFC tags may require some sort of authentication before being able to read them. Also, a QR code can be considered as a "read-only" memory (once it's printed, it can only be read), while NFC tags can usually be both written and read.

(UltraManager Pro) Version 1.3 released:
- Some users reported problems when writing certain tags using certain phones: I have introduced a toggle button: when "ON" the app will use the "transceive" function to write/read the tag, when "OFF", the usual functions are used. If the app was working fine prior this update, keep the toggle "OFF".
- The numbers next to the words now change color based on the word's status (based on the lock bytes value (bytes 02 & 03, word 02)):
. Red: Read-only
. Orange: Partially writable
. Green: Writable
The price is still € 0.99.
From now on, I will likely only support the Pro version (I will only update the Lite version in case of major bugs, but new features won't be added anymore).

_darkjoker_ said:
(UltraManager Pro) Version 1.3 released:
- Some users reported problems when writing certain tags using certain phones: I have introduced a toggle button: when "ON" the app will use the "transceive" function to write/read the tag, when "OFF", the usual functions are used. If the app was working fine prior this update, keep the toggle "OFF".
- The numbers next to the words now change color based on the word's status (based on the lock bytes value (bytes 02 & 03, word 02)):
. Red: Read-only
. Orange: Partially writable
. Green: Writable
The price is still € 0.99.
From now on, I will likely only support the Pro version (I will only update the Lite version in case of major bugs, but new features won't be added anymore).
Click to expand...
Click to collapse
I know its been a while, but i got the pro version a while ago and then forgot about it. What exactly can i do with this? My opal card has a mifare ultralight nfc chip and i was wondering what i could do to it?

how to create NFC tag to open Yale real living lock

I seen a video on youtube where someone had an NFC tag that opened his smart lock when he touched it with his n5. Can anyone give me directions or link to where I can find how to do this? Thanks

Could I somehow use tasker to control my revolv automation to open it?

I've seen this video where somebody uses a Samsung Galaxy S4.
I believe it indeed uses Tasker (if you look closely you can see that it is installed on the phone) to trigger (using Locale NFC Plugin) the phone to communicate with a Z-Wave hub such as Vera (with the AutoVera plugin) to unlock the door.
It doesn't look like an equivalent Tasker plugin is available with the Revolv hub and it can't be done directly yet as I've been told that Yale's NFC enabled dead bolt availability has been delayed. As of now I believe you can only purchase dead bolts from the Real Living series with a Z-Wave radio module. Are expected:
ZigBee radios (about to become available)
NFC (2014/12)
Bluetooth Low Energy (Q1 2015)
Once available NFC and BLE enabled dead bolts should work with ASSA ABLOY's Seos Mobile Access system (available on Google play).

Android Phones with NFC Reader on Display- / Front-Side

Hello,
i am new to this forum and hope to post my question in the correct category.
I am looking for an Android Smartphone, which is able to detect NFC Tags on the frontside (display-side) of the device. All devices i tested can detect nfc tags on their back side, but not on the front side?
Does anyone know a device, which can read nfc tags presented on the display?
Background: I would like to use a android smartphone as time tracking device in our small company, where employees should identify themselves with an rfid tag presented on the display side of the smartphone and choose "Go" or "Leave" afterwards.
I hope, that someone can help me and thank you all for your efforts!
Best regards,
Michael