ACR122 - Card Emulation

Asked 14/4, 2011 at 10:23 Answered 21/4, 2014 at 12:18

How can I get the NFC contactless reader ACR122U to behave as a tag (card emulation mode)? The prospectus claims that the device can do card emulation, but the SDK does not seem to provide an example or documentation for this feature.

Does anybody know how to do this? Is there additional software required? Please note that my target platform is MS Windows.

Thanks in advance

Salop answered 14/4, 2011 at 10:23 Comment(4)

May be you can use ACR122U's p2p model, set it as initiator's model. I saw your another question "Android 2.3.3 NFC peer-to-peer communication with PC based NFC reader", you want nexus s talk with other PC based application. Have you implemented it? Or you use ACR122U to implement it? – Pack 16/4, 2011 at 12:25

Hi user556615, I have tried to use p2p in order to get the Nexus & ACR122U to communicate, but havent managed to get anywhere yet. – Salop 18/4, 2011 at 6:49

Hi, I am also try to use p2p communicate Nexus and acr122u, I want use libnfc to implement it,but haven't manageed, We have the same problem,If you have something new,Could you tell me? My email: [email protected] – Pack 18/4, 2011 at 6:57

In my opinion, Our major problem is to implement LLCP protocol, I find some useful source maybe to is useful to you code.google.com/p/nfc-tools – Pack 18/4, 2011 at 7:3

For "Card Emulation" or in other words, "Configure as target and wait for initiators", please refer to here: http://code.google.com/p/nfcip-java/source/browse/trunk/nfcip-java/doc/ACR122_PN53x.txt

** Command to PN532 **
0xd4 0x8c TgInitAsTarget instruction code
0x00 Acceptable modes
(0x00 = allow all, 0x01 = only allow to be
initialized as passive, 0x02 = allow DEP only)

_6 bytes (_MIFARE_)_:
0x08 0x00 SENS_RES
0x12 0x34 0x56 NFCID1
0x40 SEL_RES

_18 bytes (_Felica_)_:
0x01 0xfe 0xa2 0xa3 0xa4 0xa5 0xa6 0xa7
NFCID2
0xc0 0xc1 0xc2 0xc3 0xc4 0xc5 0xc6 0xc7
?
0xff 0xff System parameters?
0xaa 0x99 0x88 0x77 0x66 0x55 0x44 0x33 0x22 0x11
NFCID3
0x00 ?
0x00 ?

This is the response when an initiator activated this target:

** Response from PN532 **
0xd5 0x8d TgInitAsTarget response code
0x04 Mode
(0x04 = DEP, 106kbps)

Let me know if it works!

Butcherbird answered 20/4, 2011 at 7:39 Comment(2)

thanks for your reply - I tried it but it did not work. I'll give it another go and let you know of my progress – Salop 20/5, 2011 at 8:24

This looks promising. Has anybody gotten this to work successfully? – Leavelle 27/1, 2013 at 0:56

Also you can try to send the following ADPU in HEX to put the reader in "Card emulation" mode:

FF 00 00 00 27 D4 8C 00 08 00 12 34 56 40 01 FE A2 A3 A4 A5 A6 A7 C0 C1 C2 C3 C4 C5 C6 C7 FF FF AA 99 88 77 66 55 44 33 22 11 00 00

Butcherbird answered 20/4, 2011 at 7:42 Comment(4)

Hi Marko, I got back the following response: D5 8D 26 1E D4 01 FE A2 A3 A4 A5 A6 A7 32 46 66 6D 01 01 10 03 02 01 04 01 96 90 – Salop 21/4, 2011 at 13:16

I'n not sure what it means, but I never managed to get an ID or read the sectors of the emulated card. – Salop 21/4, 2011 at 13:17

Anyone figured this out? I tried the above - got the same response as chalad (using javax.smartcardio to the ACR122U). The response comes when you put the NEXUS S onto the ACR122U reader. In the NEXUS S logs it shows as discovering a P2P target but gets an NFCSTATUS FAILED. I guess understanding the components of the TgInitAsTarget will be necessary to proceed further. – Programme 1/9, 2011 at 6:34

I tried this command but only got a 63 / error response. Any idea what I did wrong? Any commands I have to send first? – Methoxychlor 28/2, 2013 at 12:12

For getting the ACR122 (or rather the PN532 NFC controller chip inside it) into card emulation mode, you would do about the following:

ReadRegister:

> FF000000 08 D406 6305 630D 6338
< D507 xx yy zz 9000

Update register values:

xx = xx | 0x004;  // CIU_TxAuto |= InitialRFOn
yy = yy & 0x0EF;  // CIU_ManualRCV &= ~ParityDisable
zz = zz & 0x0F7;  // CIU_Status2 &= ~MFCrypto1On

WriteRegister:

> FF000000 11 D408 6302 80 6303 80 6305 xx 630D yy 6338 zz
< D509 9000

SetParameters:
```
> FF000000 03 D412 30
< D513 9000
```

TgInitAsTarget

> FF000000 27 D48C 05 0400 123456 20 000000000000000000000000000000000000 00000000000000000000 00 00
< D58D xx ... 9000

Where xx should be equal to 0x08.

Communicate using a sequence of TgGetData and TgSetData commands:
```
> FF000000 02 D486
< D587 xx <C-APDU> 9000
```
Where xx is the status code (should be 0x00 for success) and C-APDU is the command sent from the reader.
```
> FF000000 yy D48E <R-APDU>
< D587 xx 9000
```
Where yy is 2 + the length of the R-APDU (response) and xx is the status code (should be 0x00 for success).

Joanne answered 21/4, 2014 at 12:18 Comment(2)

When i send the TgInitAsTarget i don't get any response. The response is empty.. Do you know what the cause is? I send this:

{(byte)0xFF, 0x00, 0x00, 0x00 , 0x27 , (byte)0xD4, (byte)0x8C , 0x05 , 0x04, 0x00 , 0x12, 0x34, 0x56 , 0x20 , 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 , 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 , 0x00}

– Ushaushant 15/7, 2014 at 21:2

It look like this only works when i put my phone on the reader.. Any idea? – Ushaushant 15/7, 2014 at 21:19

You can use LibNFC. It has example code for this.

I still never got this working properly in Windows unfortunately. You will probably have to compile libnfc for specific drivers.

Also, the ACR122u seems to be pretty poorly supported by many libraries. Apparently it's not really designed for this use. There are particular issues for card emulation too (such as the timeout). We really all need to stop by the ACR122u. I just bought what was popular and easy to get hold of but regret it now.

To future browsers/searchers coming across this: please check the compatibility section on the libnfc site and buy something that they recommend!

Neumann answered 25/5, 2013 at 1:42 Comment(0)

Recommended topics

Hot tags