Reading UIDs of NFC Cards in iOS 13

Question

I would like to retrive the UID of MiFare cards. I'm using an iPhone X, Xcode 11 and iOS 13.

I'm aware this wasn't possible (specifically reading the UID) until iOS 13 according to this website: https://gototags.com/blog/apple-expands-nfc-on-iphone-in-ios-13/ and this guy: https://www.reddit.com/r/apple/comments/c0gzf0/clearing_up_misunderstandings_and/

The phones NFC reader is correctly detecting the card however the unique identifier is always returned as empty or nil. I can read the payload however and irrelvant to iOS but I can do this in Android (confirms the card isn't faulty or just odd)

Apple Sample Project: https://developer.apple.com/documentation/corenfc/building_an_nfc_tag-reader_app

    func tagReaderSession(_ session: NFCTagReaderSession, didDetect tags: [NFCTag]) {
            if case let NFCTag.miFare(tag) = tags.first! {
                session.connect(to: tags.first!) { (error: Error?) in
                    let apdu = NFCISO7816APDU(instructionClass: 0, instructionCode: 0xB0, p1Parameter: 0, p2Parameter: 0, data: Data(), expectedResponseLength: 16)
                    tag.queryNDEFStatus(completionHandler: {(status: NFCNDEFStatus, e: Int, error: Error?) in
                        debugPrint("\(status) \(e) \(error)")
                    })
                    tag.sendMiFareISO7816Command(apdu) { (data, sw1, sw2, error) in
                        debugPrint(data)
                        debugPrint(error)
                        debugPrint(tag.identifier)
                        debugPrint(String(data: tag.identifier, encoding: .utf8))
                    }
                }
            }
        }

I'm aware these sorts of hacks: CoreNFC not reading UID in iOS

But they are closed and only apply to iOS 11 for a short time in the past.

Ensile

Answer 1

Ok I have an answer.

tag.identifier isn't empty -- per se -- if you examine from Xcodes debugger it appears empty (0x00 is the value!). It's type is Data and printing it will reveal the length of the Data but not how it's encoded. In this case it's a [UInt8] but stored as a bag of bits, I don't understand why Apple have done it this way -- it's clunky -- I'm sure they have good reasons. I would have stored it as a type String -- after all the whole point of a high level language like Swift is to abstract us away from such hadware implementation details.

The following code will retrive the UID from a MiFare card:

if case let NFCTag.miFare(tag) = tags.first! {
    session.connect(to: tags.first!) { (error: Error?) in
        let apdu = NFCISO7816APDU(instructionClass: 0, instructionCode: 0xB0, p1Parameter: 0, p2Parameter: 0, data: Data(), expectedResponseLength: 16)
        tag.sendMiFareISO7816Command(apdu) { (apduData, sw1, sw2, error) in
            let tagUIDData = tag.identifier
            var byteData: [UInt8] = []
            tagUIDData.withUnsafeBytes { byteData.append(contentsOf: $0) }
            var uidString = ""
            for byte in byteData {
                let decimalNumber = String(byte, radix: 16)
                if (Int(decimalNumber) ?? 0) < 10 { // add leading zero
                    uidString.append("0\(decimalNumber)")
                } else {
                    uidString.append(decimalNumber)
                }
            }
            debugPrint("\(byteData) converted to Tag UID: \(uidString)")
        }
    }
}

Ensile

You don't need to connect or send the APDU if you just want to print the identifier. After tags.first! { you can do print(tag.identifier as NSData) to see the contents in your console. – Taillight

Thanks Scott -- I'll mark yours as the right answer once I can verify how your solution works. It's a slightly different approach to mine. – Ensile

Hey @ScottCondron . Can you look into this question please. Its really hard to find the required support at these initialal days NFC in iOS 13 #58192248 – Paphos

Answer 2

I know you have said that it returns nil but for clarity for future readers:

Assuming it is not a Felica tag, it should be on the identifier field when it is detected:

func tagReaderSession(_ session: NFCTagReaderSession, didDetect tags: [NFCTag]) {      
  if case let NFCTag.miFare(tag) = tags.first! {
    print(tag.identifier as NSData)
  }
}

But in your case, it's empty (see edit below). For most tags the APDU to get the UID of a tag is

  0xff // Class
  0xca // INS
  0x00 // P1
  0x00 // P2
  0x00 // Le

so you could try using tag.sendMiFareCommand to send that command manually.

Edit: Response from OP, it wasn't empty but was unclear because printing Data in Swift doesn't show in console

Taillight

I'm trying to implement this with a newer xcode than what was around in sep 18 and having some trouble. the didDetedt NFCTag] isn't triggered and also i have a warning from xcode that it almost matches their optional protocol method... so i updated the newer one and then can't cast to mifare. Have you implemented this in the latest version? full q here if you have a chance: #58285925 – Lainelainey

Answer 3

In iOS13 I was able read the Tag.identifier value for various MIFARE family's DESfire and UltraLight tags same as @scott-condron's answer, but for various MIFARE Classic ICs (the unknown family member?) my Console shows different error types.

Perhaps private framework APIs similar to the iOS11 work-around in the hack you mentioned would be helpful in these cases, e.g. to intercept and amend the discovery polling routine, but I wouldn't know which ones or how to use them.

Below you can find some test results for MIFARE Classic 4K (emulation) tags, as also reported in this github thread and this MIFARE support thread. Following Table 6 of Application Note #10833, the Select Acknowledge (SAK) value of 0x38 of the emulation tags below translates into 0 0 1 1 1 0 0 0 for bits 8..1, i.e. bits 6, 5, and 4 are 1, and therefore these SAK values classify as Smart MX with CLASSIC 4K as per Figure 3 of Application Note #10834.

1. an Infineon Classic 4k Emulation successfully logs 1 tags found with the correct UID (31:9A:2F:88), ATQA (0x0200), SAK (detects 0x20, i.e. ISO 14443-4 protocol, and 0x18, i.e. MIFARE 4K, both part of the expected value: 0x38) and respective tag type (both Generic 4A and MiFare classified correctly), but then throws a Stack Error:

   error   14:48:08.675369 +0200   nfcd    00000001 04e04390 -
       [NFDriverWrapper connectTag:]:1436  Failed to connect to tag: 
       <NFTagInternal: 0x104e05cd0>-{length = 8, bytes = 0x7bad030077180efa} 
       { Tech=A Type=Generic 4A ID={length = 4, bytes = 0x319a2f88} 
       SAK={length = 1, bytes = 0x20} ATQA={length = 2, bytes = 0x0200} historicalBytes={length = 0, bytes = 0x}}
   :
   error   14:48:08.682881 +0200   nfcd    00000001 04e04390 -
       [NFDriverWrapper connectTag:]:1436  Failed to connect to tag: 
       <NFTagInternal: 0x104e1d600>-{length = 8, bytes = 0x81ad0300984374f3} 
       { Tech=A Type=MiFare ID={length = 4, bytes = 0x319a2f88} 
       SAK={length = 1, bytes = 0x18} ATQA={length = 2, bytes = 0x0200} historicalBytes={length = 0, bytes = 0x}}
   :
   default 14:48:08.683150 +0200   nfcd    00000001 04e07470 -
       [_NFReaderSession handleRemoteTagsDetected:]:445  1 tags found
   default 14:48:08.685792 +0200   nfcd    00000001 04e07470 -
       [_NFReaderSession connect:callback:]:507  NFC-Example
   :
   error   14:48:08.693429 +0200   nfcd    00000001 04e04390 -
       [NFDriverWrapper connectTag:]:1436  Failed to connect to tag: 
       <NFTagInternal: 0x104e05cd0>-{length = 8, bytes = 0x81ad0300984374f3} 
       { Tech=A Type=MiFare ID={length = 4, bytes = 0x319a2f88} 
       SAK=(null) ATQA=(null) historicalBytes={length = 0, bytes = 0x}}
   :
   error   14:48:08.694019 +0200   NFC-Example 00000002 802e2700 -
       [NFCTagReaderSession _connectTag:error:]:568  Error 
       Domain=NFCError Code=100 "Stack Error" UserInfo={NSLocalizedDescription=Stack Error, NSUnderlyingError=0x2822a86c0 
       {Error Domain=nfcd Code=15 "Stack Error" UserInfo={NSLocalizedDescription=Stack Error}}}
   

2. an NXP SmartMX (Classic 4k emulation) with UID CF:3E:40:04 is discovered initially, but a reception error during ISO 14443-4A presence check (Proc Iso-Dep pres chk ntf: Receiption failed) continuously restarts the discovery polling until the session finally expires, possibly preventing the other SAK value 0x18 (for MIFARE 4K tag type) to be received:

   error   10:44:50.650673 +0200   nfcd    Proc Iso-Dep pres chk ntf: Receiption failed
   :
   error   10:44:50.677470 +0200   nfcd    00000001 04e04390 -
       [NFDriverWrapper disconnectTag:tagRemovalDetect:]:1448  Failed to disconnect tag: 
       <NFTagInternal: 0x104f09930>-{length = 8, bytes = 0x07320d00f3041861} 
       { Tech=A Type=Generic 4A ID={length = 4, bytes = 0xcf3e4004} 
       SAK={length = 1, bytes = 0x20} ATQA={length = 2, bytes = 0x0200} historicalBytes={length = 0, bytes = 0x}}
   default 10:44:50.677682 +0200   nfcd    00000001 04e04390 -
       [NFDriverWrapper restartDiscovery]:1953
   

3. an actual NXP Classic 4k with UID 2D:FE:9B:87 remains undetected and throws no error. The discovery polling session for this tag simply times out after 60 seconds and logs the last 128 discovery messages transmitted (Tx) and received (Rx), among which the following pattern is repeated (which does include the expected UID: 2D FE 9B 87):

   error   11:42:19.511354 +0200   nfcd    1571305339.350902 Tx  '21 03 07 03 FF 01 00 01 01 01 6F 61'
   error   11:42:19.511484 +0200   nfcd    1571305339.353416 Rx  '41 03 01'
   error   11:42:19.511631 +0200   nfcd    1571305339.353486 Rx  '00 F6 89'
   error   11:42:19.511755 +0200   nfcd    1571305339.362455 Rx  '61 05 14'
   error   11:42:19.511905 +0200   nfcd    1571305339.362529 Rx  '01 80 80 00 FF 01 09 02 00 04 2D FE 9B 87 01 18 00 00 00 00 2D 11'
   
   error   11:42:19.512152 +0200   nfcd    1571305339.362734 Tx  '21 06 01 00 44 AB'
   error   11:42:19.512323 +0200   nfcd    1571305339.363959 Rx  '41 06 01'
   error   11:42:19.512489 +0200   nfcd    1571305339.364028 Rx  '00 1D 79'
   error   11:42:19.512726 +0200   nfcd    1571305339.364300 Rx  '61 06 02'
   error   11:42:19.512914 +0200   nfcd    1571305339.364347 Rx  '00 00 EB 78'
   

Outshoot