Hi,
I am trying to find out what data one device sends to an RFID chip. I can read the RFID chip (with my RFID RC522), but most of it is encoded (NTAG213F), so I would like to see if I can somehow intercept the communication from the sending device.
Anyone knows where to start such a project?
The end goal is to be able to read info from the the Da Vinci Jr. Filament chip, which is different from the regular filaments cartridges they have.
NTAG213F is NFC Forum Type 2 Tag, The libnfc supports it well.
NFC reader support libnfc for Arduino Yun
Libnfc - NFC Tools
.. which means I can act as NTAG213F from Arduino ? Or just -read- NTAG213F ?
chunklady:
.. which means I can act as NTAG213F from Arduino ?
Not with regular Arduino but with Arduino Yun or compatible.
Emulation of NFC Forum Type 2 Tag:
http://www.libnfc.org/api/nfc-emulate-forum-tag2_8c_source.html
I don't think that is emulation in the sense that the OP is talking about which is replacing a tag in a working system. To do that you would need a 3.26MHz transmitter to send the data back to the reader.
The way to eavesdrop on the tag / reader conversation is to have two readers. One at 13.5 MHz and the other at a quarter of that to listen to what the tag sends back. As far as I know you will have to make that yourself.
Grumpy_Mike:
The way to eavesdrop on the tag / reader conversation is to have two readers. One at 13.5 MHz and the other at a quarter of that to listen to what the tag sends back. As far as I know you will have to make that yourself.
Thanks - thats an exciting project right there, in itself. I will try and sketch something out !
However, I am starting to suspect it might just be easier to either brute force (unless there is max-password-attempt set in the NTAG213F) og to simply replace the entire NFC-reader module, all together. Or, download the da vinci firmware and try to find the key in there (needle/haystack situation)
Thanks !
There is normally a limit to the number of incorrect attempts at accessing a smart card before the card makes itself unreadable. It is a security thing.
chunklady:
Thanks - thats an exciting project right there, in itself. I will try and sketch something out !
However, I am starting to suspect it might just be easier to either brute force (unless there is max-password-attempt set in the NTAG213F) og to simply replace the entire NFC-reader module, all together. Or, download the da vinci firmware and try to find the key in there (needle/haystack situation)
Thanks !
Techsheet NTAG213/215/216
1.3 Security
- Manufacturer programmed 7-byte UID for each device
- Pre-programmed Capability container with one time programmable bits
- Field programmable read-only locking function
- ECC based originality signature
- 32-bit password protection to prevent unauthorized memory operations
To brute force it (ECC based originality signature) You need to access super computer which billion time powerful than Arduino, not cost-effective.
Grumpy_Mike:
I don't think that is emulation in the sense that the OP is talking about which is replacing a tag in a working system. To do that you would need a 3.26MHz transmitter to send the data back to the reader.
My misunderstand?
The NFC reader IC support card emulation which could replace card. however support level is varies.
PN533 supports:
- ISO/IEC 14443A/MIFARE Card MIFARE 1 KB or MIFARE 4 KB emulation
- FeliCa Card emulation (Type 3)
PN532 supports iso 14443-4A emulation mode (Type 4, might be Type 2 as well)
sonnyyu:
The list of NXP NFC IC chip:
- NXP PN531 Obsolete
- NXP PN532 Most of NFC shield, if not all.
- NXP PN533 (SCM SCL3711)
- NXP PR533
- NXP PN544
- NXP PN65N
- NXP PN65V10 Apple Iphone 6
- NXP PN7120
Mifare Classic is not an NFC Forum compatible card. Mifare Classic 1K/4K is not NFC card!
sonnyyu:
To brute force it (ECC based originality signature) You need to access super computer which billion time powerful than Arduino, not cost-effective.
Or just try random combinations and get lucky. Kinda like the lottery 