NFC

Main Fields

File Example

Filetype: Flipper NFC device
Version: 2
Device type: NTAG216
UID: 04 85 92 8A A0 61 81
ATQA: 44 00
SAK: 00
Signature: 1B 84 EB 70 BD 4C BD 1B 1D E4 98 0B 18 58 BD 7C 72 85 B4 E4 7B 38 8E 96 CF 88 6B EE A3 43 AD 90
Mifare version: 00 04 04 02 01 00 13 03

These fields are part of the NFC protocol and are used to identify and configure the NFC tag:

UID (Unique Identifier)

• A unique identifier for the NFC tag. It’s like a serial number.

ATQA (Answer to Request)

• Indicates the tag’s type and capabilities.

SAK (Select Acknowledge)

• Confirms the tag’s type and protocol compatibility.

• This byte indicates the tag’s status in response to a request.

• It’s often used in combination with ATQA to determine access rights and compatibility with certain devices or reader types.

Signature

• A cryptographic signature used for authentication (optional).

Mifare version

• Indicates the version of the Mifare protocol used by the tag.

• In Mifare tags, each memory sector can be individually protected by keys.

• These keys (often referred to as Key A and Key B) can be used to lock down access to specific sectors, allowing different users or systems to read or write only certain sections based on the permissions associated with the keys.

Counters and Tearing Flags

File Example

Counter 0: 0
Tearing 0: 00
Counter 1: 0
Tearing 1: 00
Counter 2: 0
Tearing 2: 00

Counters

• These are 32-bit counters that can be used to track how many times the NFC tag has been read or written.

• Each counter has a tearing flag.

Tearing Flags

• These are 8-bit flags used to prevent tearing (partial writes) during a write operation.

• Tearing occurs when power is lost during a write, leaving the tag in an inconsistent state.

• The tearing flags help ensure that writes are atomic (either fully completed or not at all).

Tag Pages

File Example

Page 0: 04 39 91 24
Page 1: C2 FC 67 80
Page 2: D9 48 00 00
Page 3: E1 10 12 00
Page 4: 01 03 A0 0C
Page 5: 34 03 19 D1
Page 6: 01 15 55 04
Page 7: 79 6F 75 74
Page 8: 75 2E 62 65
Page 9: 2F 64 51 77
Page 10: 34 77 39 57
Page 11: 67 58 63 51
Page 12: FE 00 00 00

The data is stored in hexadecimal format, and each page typically contains 4 bytes of data.

Metadata Tags

Pages 0-6 contain critical metadata and configuration data. Here’s a breakdown of what each page typically stores:

• Page 0: Contains the UID (Unique Identifier).

  • The UID is a unique serial number assigned to the tag during manufacturing.

• Page 1-2: Contain the Capability Container (CC) and other configuration data.

  • The CC defines the tag’s memory size, supported features, and access permissions.

• Page 3: Often contains lock bits or additional configuration.

  • Lock bits determine which parts of the tag’s memory are read-only or writable.

  • For tags that require tamper-proof data, this feature can be crucial. Once locked, a section of memory cannot be altered, which can prevent malicious or accidental modifications.

• Page 4-6: May contain additional metadata, such as manufacturer data or signature.

  • These pages are often used for tag-specific data or reserved for future use.

Data Tags

When concatenated, these pages form the URL: youtu.be/dQw4w9WgXcQ, which is the classic Rickroll:

• Page 7: 79 6F 75 74 → yout

• Page 8: 75 2E 62 65 → u.be

• Page 9: 2F 64 51 77 → /dQw

• Page 10: 34 77 39 57 → 4w9W

• Page 11: 67 58 63 51 → gXcQ

Termination Marker

• This marker tells the NFC reader where the useful data ends, so it doesn’t try to interpret the empty pages as part of the data message --> FE 00 00 00

Cryptographic Protection

• Symmetric Encryption (Shared Secret Key): In this system, both the NFC tag and the reader share the same key. The tag and the reader must first authenticate the key before communication occurs.

• Asymmetric Encryption (Public/Private Key): In more advanced systems, NFC tags may use asymmetric encryption, where the reader has a public key and the NFC tag has a corresponding private key.

• Hardware security modules (HSMs) are sometimes used to store these keys securely on the reader or the tag itself.