Topic: Mifare Classic SoftTag Emulation
Hello,
I would appreciate some help regarding the emulation scenarios below.
The below research is for MFCUK SoftTag 100% emulation tool for Mifare Classic. If anyone would like to join the efforts - welcome!
1. Setup used is:
- ACR122 emulates a TAG (using a default/modified nfc-emulate.c) with libnfc 1.2.1
- Omnikey 5131 is the READER (using Omnikey Diagnostic Tool to check the TAG in its field). Reasons:
-- first, I don't have a second ACR122
-- second, having different hardware in the setup would prove more interoperability rather than using just two ACR122 devices
2. First tests and then questions:
- if I use the default nfc-emulate.c, I get a VERY "short presence" (~1 sec) of the emualted-tag in the Diagnostic Tool (I suppose because of nfc_target_init()) and then nothing happens (i.e. the nfc-emulate.c while() loop is not tranceiving anyting)
- RESULTS:
-- very short DETECTED presence of the ACR122 emulated tag detected by Omnikey
-- the initiator command received is: "e0 81"
-- UID detected: 08 00 B0 0B (because of nfc_target_init() hardcoded 00 B0 0B) (btw, is anyone seeing any b00bs in nfc?! 
)
-- ATR detected: 3B 80 80 01 01
-- please check this screenshot - http://andreicostin.com/MFCUK/emulate_result1.png
- QUESTIONS:
-- what does "e0 81" mean? couldn't make a clue out of it... i'm dumb at this
-- why nothing happens in the:
while(true)
{
// Test if we received a frame
if (nfc_target_receive_bits(pdi,abtRecv,&uiRecvBits,NULL))
loop of the emulation? is ACR122 tranceiving incompatibile/time-unsynced with Omnikey (I suppose it should not)?
3. Second tests and then questions:
- modified the default nfc-emulate.c such that it does:
while(true)
{
if (!nfc_target_init(pdi,abtRecv,&uiRecvBits))
{
printf("Error: Could not come out of auto-emulation, no command was received\n");
return 1;
}
printf("[+] Received initiator command: ");
print_hex_bits(abtRecv,uiRecvBits);
}
- modified in libnfc.c the function nfc_target_init():
// Set UID
// zveriu - use our old friend DEADBEEF
pncmd_target_init[5] = 0xDD;
pncmd_target_init[6] = 0xBE;
pncmd_target_init[7] = 0xEF;
- RESULTS:
-- TAG is with constant periodicity (2-3 times a second) detected by Omnikey, Omnikey reader leds blinking periodically while reading tag info and Diagnostic Tool detects a tag in field
-- UID detected: 08 DD BE EF (as modified in nfc_target_init() )
-- ATR detected: 3B 80 80 01 01
-- please check this screenshot - http://andreicostin.com/MFCUK/emulate_result2.png
- QUESTIONS:
-- why nfc_target_init() configures only 3 bytes of UID? why not 4 bytes? (though should check the mnemonic of D4 8C command since nfc_target_init is using byte_t pncmd_target_init[39] = { 0xD4,0x8C };)
-- where does 08 first byte of UID comes from? is it possible to control it as well as I did with last 3 bytes of UID?
-- where does the ATR sequence comes from? is it possible to control it so that it matches one of Mifare Classic ATR/ATS? (http://ludovic.rousseau.free.fr/softwar … d_list.txt)
Sorry for the long post. Hope someone can answer with few useful pointers.
Thanks,
Andrei Costin
http://andreicostin.com
http://code.google.com/p/tk-libnfc-crapto1/
