Is this the case on Mifare Plus cards?
Is there Any research done on the mifare plus cards?
Is there any other papers on the nested attack than Pickpocketing & Darkside?

Thank you,

Thank you,

Thank you,

My process is following.
-I connect ACR122 to the Windows PC by USB.
-I bump the android terminal to the ACR122.
-I execute TgInitAsTarget command of PN533 from the PC to ACR122.
I set DEP connection(0x40) in SEL_RES.
-Gi in ATR_REQ means LLCP connection in response of TgInitAsTarget.

Thank you,

- libnfc-1.7.0-rc7.tar.gz

-cmake-2.8.10.2-win32-x86 [MinGw-W64]
- tdm-gcc-4.7.1-2
- libusb-win32-bin-1.2.6.0
- pcre-7.0
- doxygen [Cmake told me it was missing]

and using the GUI of CMAKE I selected:

- USB Lib Include: libusb-win32-bin-1.2.6.0/include
- USB Lib library: libusb-win32-bin-1.2.6.0/lib/bcc/libusb.lib
- PCRE Include:C:/Program Files (x86)/GnuWin32/include
- PCRE Lib:C:/Program Files (x86)/GnuWin32/lib/pcre.lib

In the GUI I wrote location of the source code: C:/libnfc-1.7.0-rc7/libnfc-1.7.0-rc7
And where to build the file: C:\BuildNFC

And I receive this output:

Found PCRE: C:/Program Files (x86)/GnuWin32/lib/pcre.lib C:/Program Files (x86)/GnuWin32/include
Found LIBUSB: C:/Users/Dany/Documents/NFC-attacks/libusb-win32-bin-1.2.6.0/lib/bcc/libusb.lib C:/Users/Dany/Documents/NFC-attacks/libusb-win32-bin-1.2.6.0/include
Year for copyright is 2013
Configuring done
Generating done

After this I looked inside of the folder BuildNFC and I found many files but nothing like nfc.dll or ".h" files or ".c" files.

What should I do in order to use this library?

Thank you very much. Sorry for this dummies question but I am working on this problem without find the solution.

Because of the usb ids, it's internally recognised by the acr122_usb driver as an "ACR122" device (libnfc/drivers/acr122_usb.c:255) . The funny thing is that once I make it recognise as a TOUCHATAG reader, it works!

I'm offering to help improve the acr122 driver to support my particular touchatag reader more reliably.
So I have a few questions:
1) The internal driver type (TOUCHATAG or ACR122) seems to have effect only on some initialisation sequence and on the behaviour for getting the response to a command (the reader responds with an SW12 of 61xx so the driver sends a GetResponse APDU to get the actual response data). Can't we make this more automatic? Like detect the 61xx error code as a special case for all acr122_usb-like readers?
2) I noticed there is a chip card (like a SAM or SIM) embedded in the reader. Can this possibly be used to detect the sub-version of touchatag readers?

If you need more information, please let me know.

I'm trying to get ACR122U working on Ubuntu 12.04. I've installed libnfc-1.7.0-rc7 (also tested with libnfc-1.7.0-rc6 ) and pam_nfc-0.1.4 . Both installs go through fine and my nfc-list shows the device and tag:

$ sudo nfc-list
nfc-list uses libnfc 1.7.0-rc6
NFC device: ACS / ACR122U PICC Interface opened
1 ISO14443A passive target(s) found:
ISO/IEC 14443A (106 kbps) target:
    ATQA (SENS_RES): 00  04  
       UID (NFCID1): a6  14  34  fc  
      SAK (SEL_RES): 08  

I should note here that running the command without sudo returns this:

nfc-list uses libnfc 1.7.0-rc6
error    libnfc.driver.acr122_usb    Unable to claim USB interface (Operation not permitted)
nfc-list: ERROR: Unable to open NFC device: acr122_usb:003:003

I've tried adding the nfc to blacklist in /etc/modprobe.d/, unfortunately without success.

If I try adding user to the tag

sudo pam-nfc-add dejan

I get a segfault:

kernel: [ 2586.693391] pam-nfc-add[2640]: segfault at 0 ip 006e2848 sp bfbf6fa0 error 6 in libnfc.so.4.0.0[6df000+1b000]

Any suggestions? Is this procedure even correct for the acr122u? Thanks in advance for answers.

Best regards,

Dejan

pcscd -f
00000000 ccid_usb.c:950:WriteUSB() usb_bulk_write(005/004): Device or resource busy
00000054 ifdwrapper.c:348:IFDStatusICC() Card not transacted: 612
00000008 eventhandler.c:303:EHStatusHandlerThread() Error communicating to: ACS ACR122U 00 00
i upgrade to my new version 1.8.8 and a have this error when i execute de cammand 00000000 hotplug_libudev.c:96:HPReadBundleValues() Cannot open PC/SC drivers directory: /usr/local/lib/pcsc/drivers
00000060 hotplug_libudev.c:97:HPReadBundleValues() Disabling USB support for pcscd.

mfoc -P 500 -O ola
error    libnfc.driver.acr122_usb    Too small reply
No NFC device found.
i have try to upgrade the libnfc to 1.7.0-rc7 but not upgrade
how i solve the problem
when i use the configure i have this report
./configure
fatal: Not a git repository (or any of the parent directories): .git
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /bin/mkdir -p
checking for gawk... no
checking for mawk... mawk
checking whether make sets $(MAKE)... yes
checking for style of include used by make... GNU
checking for gcc... gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables...
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether gcc accepts -g... yes
checking for gcc option to accept ISO C89... none needed
checking dependency style of gcc... gcc3
checking for ar... ar
checking the archiver (ar) interface... ar
checking whether make supports nested variables... yes
checking for gcc... (cached) gcc
checking whether we are using the GNU C compiler... (cached) yes
checking whether gcc accepts -g... (cached) yes
checking for gcc option to accept ISO C89... (cached) none needed
checking dependency style of gcc... (cached) gcc3
checking whether make sets $(MAKE)... (cached) yes
checking build system type... i686-pc-linux-gnu
checking host system type... i686-pc-linux-gnu
checking how to print strings... printf
checking for a sed that does not truncate output... /bin/sed
checking for grep that handles long lines and -e... /bin/grep
checking for egrep... /bin/grep -E
checking for fgrep... /bin/grep -F
checking for ld used by gcc... /usr/bin/ld
checking if the linker (/usr/bin/ld) is GNU ld... yes
checking for BSD- or MS-compatible name lister (nm)... /usr/bin/nm -B
checking the name lister (/usr/bin/nm -B) interface... BSD nm
checking whether ln -s works... yes
checking the maximum length of command line arguments... 1572864
checking whether the shell understands some XSI constructs... yes
checking whether the shell understands "+="... yes
checking how to convert i686-pc-linux-gnu file names to i686-pc-linux-gnu format... func_convert_file_noop
checking how to convert i686-pc-linux-gnu file names to toolchain format... func_convert_file_noop
checking for /usr/bin/ld option to reload object files... -r
checking for objdump... objdump
checking how to recognize dependent libraries... pass_all
checking for dlltool... no
checking how to associate runtime and link libraries... printf %s\n
checking for archiver @FILE support... @
checking for strip... strip
checking for ranlib... ranlib
checking command to parse /usr/bin/nm -B output from gcc object... ok
checking for sysroot... no
checking for mt... mt
checking if mt is a manifest tool... no
checking how to run the C preprocessor... gcc -E
checking for ANSI C header files... yes
checking for sys/types.h... yes
checking for sys/stat.h... yes
checking for stdlib.h... yes
checking for string.h... yes
checking for memory.h... yes
checking for strings.h... yes
checking for inttypes.h... yes
checking for stdint.h... yes
checking for unistd.h... yes
checking for dlfcn.h... yes
checking for objdir... .libs
checking if gcc supports -fno-rtti -fno-exceptions... no
checking for gcc option to produce PIC... -fPIC -DPIC
checking if gcc PIC flag -fPIC -DPIC works... yes
checking if gcc static flag -static works... yes
checking if gcc supports -c -o file.o... yes
checking if gcc supports -c -o file.o... (cached) yes
checking whether the gcc linker (/usr/bin/ld) supports shared libraries... yes
checking whether -lc should be explicitly linked in... no
checking dynamic linker characteristics... GNU/Linux ld.so
checking how to hardcode library paths into programs... immediate
checking whether stripping libraries is possible... yes
checking if libtool supports shared libraries... yes
checking whether to build shared libraries... yes
checking whether to build static libraries... yes
Fixing libtool for -rpath problems.
checking for pkg-config... /usr/bin/pkg-config
checking for ANSI C header files... (cached) yes
checking for stdbool.h that conforms to C99... yes
checking for _Bool... yes
checking fcntl.h usability... yes
checking fcntl.h presence... yes
checking for fcntl.h... yes
checking limits.h usability... yes
checking limits.h presence... yes
checking for limits.h... yes
checking stdio.h usability... yes
checking stdio.h presence... yes
checking for stdio.h... yes
checking for stdlib.h... (cached) yes
checking for stdint.h... (cached) yes
checking stddef.h usability... yes
checking stddef.h presence... yes
checking for stddef.h... yes
checking for stdbool.h... (cached) yes
checking sys/ioctl.h usability... yes
checking sys/ioctl.h presence... yes
checking for sys/ioctl.h... yes
checking sys/param.h usability... yes
checking sys/param.h presence... yes
checking for sys/param.h... yes
checking sys/time.h usability... yes
checking sys/time.h presence... yes
checking for sys/time.h... yes
checking termios.h usability... yes
checking termios.h presence... yes
checking for termios.h... yes
checking linux/spi/spidev.h usability... yes
checking linux/spi/spidev.h presence... yes
checking for linux/spi/spidev.h... yes
checking for memmove... yes
checking for memset... yes
checking for select... yes
checking for strdup... yes
checking for strerror... yes
checking for strstr... yes
checking for strtol... yes
checking for usleep... yes
checking for size_t... yes
checking for uint8_t... yes
checking for uint16_t... yes
checking for uint32_t... yes
checking for uint64_t... yes
checking for int16_t... yes
checking for int32_t... yes
checking for off_t... yes
checking for log flag... yes
checking for conffiles flag... yes
checking for envvars flag... yes
checking for debug flag... no
checking which drivers to build... default drivers
checking for documentation request... no
checking pkg-config is at least version 0.9.0... yes
checking for libusb... yes
checking for CUTTER... no
checking for readline.h... /usr/include/readline/readline.h
configure: creating ./config.status
config.status: creating Doxyfile
config.status: creating Makefile
config.status: creating cmake/Makefile
config.status: creating cmake/modules/Makefile
config.status: creating contrib/Makefile
config.status: creating contrib/devd/Makefile
config.status: creating contrib/libnfc/Makefile
config.status: creating contrib/linux/Makefile
config.status: creating contrib/udev/Makefile
config.status: creating contrib/win32/Makefile
config.status: creating contrib/win32/sys/Makefile
config.status: creating contrib/win32/libnfc/Makefile
config.status: creating contrib/win32/libnfc/buses/Makefile
config.status: creating examples/Makefile
config.status: creating examples/pn53x-tamashell-scripts/Makefile
config.status: creating include/Makefile
config.status: creating include/nfc/Makefile
config.status: creating libnfc.pc
config.status: creating libnfc/Makefile
config.status: creating libnfc/buses/Makefile
config.status: creating libnfc/chips/Makefile
config.status: creating libnfc/drivers/Makefile
config.status: creating test/Makefile
config.status: creating utils/Makefile
config.status: creating config.h
config.status: config.h is unchanged
config.status: executing depfiles commands
config.status: executing libtool commands

Selected drivers:
   acr122_pcsc...... no
   acr122_usb....... yes
   acr122s.......... yes
   arygon........... yes
   pn53x_usb........ yes
   pn532_uart....... yes
   pn532_spi.......  yes

I'm trying to make a fuzzer for NFC (and libnfc in particular) using an Android device (with Cyanogenmod to be able to emulate tags). As far as I know at the moment, Android is only capable of using NFC using APDU's.

The PCD I'm using is a tikitag with firmware ACR122U1.

I've managed to communicate between the PCD and the 'tag' (thus, Android device) in Java using the smartcardio library on my PC (PCD-side). What I'm trying now is doing the same but with libnfc in C or C++. The problem is I don't know how to send APDU's (or something similar so the NFCAdapter in Android will pick up the frame) with libnfc.

The anti-collision in C works just fine, but when trying to send an InDataExchange, it stops and waits forever for a reply.

REQA          | 26
ATQA          | 04  00
SEL (all)     | 93  20
UID, BCC      | 08  b8  c3  15  66
SEL (tag)     | 93  70  08  b8  c3  15  66  1f  0f
SAK           | 60  f8  32
RATS          | e0  50
ATS           | 05  78  33  88  00  59  b2

A normal APDU for PCD to tag would be something like this:

0xFF, 0x00, 0x00, 0x00, 0x04, 0xD4, 0x40, 0x01, 0xBA

In this example, the first 4 bytes are a pseudo-APDU to make sure the APDU is sent directly to the tag. The next byte is the length of the APDU itself. The 0xD4 0x40 0x01 is the InDataExchange command, telling all following bytes are data to be exchanged with the tag.

Any help is appreciated.

with Libnfc1.6.0rc1 every 2 attempts to perform most examples results in an error.

Now I installed libnfc1.7.0rc7 and if I run an example with LIBNFC_LOG_LEVEL=3 preceding it, the command runs well, however whenever I run a command without the debug I get this.

nfc-list uses libnfc 1.7.0-rc7
pn53x_check_communication: Timeout
nfc-list: ERROR: Unable to open NFC device: pn532_uart:/dev/ttyAMA0

Many others are having a similar issue.
Is there something I am missing?

When compiling in win32 (Windows 7) fails me mingw32-make to compile the library configured with CMake (cmake-2.8.10.2-win32-x86) in all rc files generated:

example of error:

[ 38%] Building RC object utils/CMakeFiles/nfc-list.dir/__/windows/nfc-list.rc.o
bj
c:\libnfc\libnfc-build\windows\nfc-list.rc:2
5:37: warning: missing terminating " character [enabled by default]
c:\libnfc\libnfc-build\windows\nfc-list.rc:2
6:3: warning: missing terminating " character [enabled by default]
C:\MinGW\bin\windres.exe: c:\\libnfc\\libnfc-build\\windows\\nfc-list.rc:26: syntax error
mingw32-make[2]: *** [utils/CMakeFiles/nfc-list.dir/__/windows/nfc-list.rc.obj]
Error 1
mingw32-make[1]: *** [utils/CMakeFiles/nfc-list.dir/all] Error 2
mingw32-make: *** [all] Error 2

This is due to a bad interpretation of variable @ CURRENT_YEAR @ in file \ contrib \ win32 \ version.rc.in, which generates a newline character.

source:

VALUE "LegalCopyright", "Copyright (C) @CURRENT_YEAR@\0"

result:

            VALUE "InternalName", "nfc-list release\0"
            VALUE "LegalCopyright", "Copyright (C) 05-05-2013 
\0"
            VALUE "OriginalFilename", "nfc-list.exe\0"

I'm not sure if it's a particular problem o general, but I leave it as information if required to do some correction.

I need some advice on how to start and to properly configure my environment to run tests directly to the driver without having to compile the whole project.
You use any IDE? as you prepare your work environment?. any help or advice is welcome.

PS: excuse my English, it is thanks to google traslator: p

Regards,

First of all I'd like to introduce myself:) Hi to everybody and thanks for your helping hands!

My problem...

I'm trying to initialize a Mifare Plus S 2K using an ACR122T and some APDUs. I've been racking my brains trying to figure out how to do it! (I've read all app notes from NXP, datasheets, ISOs and so on)

Does anyone know which are the APDUs required to fulfil the initialization?

Any advice/help will be appreciated!

Thank you in advance:)