Unlock mifare tag with android

Question

I'm looking for a way to send the unlock sequence from an Android phone to a Mifare tag from the Chinese manufacturer that makes the ones with a writable block 0.

I've been trying the connect + transceive methods, sending the 50 00 + 40 + 43 byte sequences. But that won't work.

I've tried the private transceive function (to get around error checking), but that won't work either. I get errors from the nfc service.

Has anyone successfully been able to send the unlock sequence to unlock block0?

Doubletime

I don't understand why this question was closed. – Doubletime

I voted to reopen, but you might want to consider adding some of your code, or exactly what errors you're receiving. The specific type of Mifare tag would help, too. – Canaster

I think the comment from developer.android.com/reference/android/nfc/tech/… about "full bytes" is relevant here, as in libnfc the unlock command is sent in bits (7 bits, to be precise) and this is not possible with the public API of Android. I'm looking for the same thing, maybe there's a possibility to bypass something and make use of internal/private interfaces. – Ferreous

I'll do some more reflection-reversing of the private API. If I find anything I'll post it here. – Doubletime

Answer 1

This is not possible on an Android device. The proprietary commands for the Chinese MIFARE clone are 7 bits long, not a complete byte. The NFC implementations in Android devices (both the older with proprietary interface and the newer NFC Forum NCI compliant ones) work on payload buffers of complete bytes.

Illuminance

I was afraid of that answer :/ Any chance some guy write a patch for android ? seems a bit too hard for me ... – Antipathy

For the older devices, the limitation is in the NFC hardware, so no software patch will fix that. I am not sure about the NCI compliant NFC hardware, but I expect that the situation there may be the same. – Illuminance

I believe that the NFC hardware you refer to is the nxp PN544 chip, I don't think there is a limitation with the chip itself. – Antipathy

The PN544 has the software stack with the older proprietary interface, yes. However, the limitation is also in the PN544 itself: the firmware does not allow you to send 7-bit commands. Only complete bytes can be offered as command payload. – Illuminance

What might be the reason that the Chinese Guys chose 7bit commands? Maybe they can update their design to include 8 bit commands, for the sake of Android adoption ? :) – Ferreous