1

I have a pn532 which I'd like to present to a reader as a passive NFC tag with an NDEF record URL on it.

Following the PN532's User Manual I can put the device into target mode, and read the first ADPU command from the phone. I can use the iso-14443-4 pdf from 2005 to see that the command is A4, Read File, and that the two parameter bytes indicate "Select by DF name, first occurrence". Past that though, I don't know how to interpret the Data Field, which should the the name of a file being requested for reading.

Furthermore, I don't know how to interpret the initial command [E080] from the phone.

The program's output: (comments with #'s) 

usart init.

i2c init.

pn532 init.

Firmware: 1.6

SAM config done.

Gen Status:

    Err code: 0x00

    Field: 0x00

    Number of tags: 0x00

Initiating as target. # Here the pn532 waits for a reader.

tgInitAsTarget. Length: 5 # Callback function once the pn532 detects a reader and retrieves the first command from it.

    Mode: 

    Baud: 106kbps, 14443-4: yes, DEP: no, Framing type: Mifare.


Initiator command: 

0xE0

0x80

Entering tg loop.

callback: tgGetData. # The tgGetData command is sent without doing anything with the initial instructions.

    status: 0x00

    0x00 0xA4 0x04 0x00 0x07 0xD2 0x76 0x00 0x00 0x85 0x01 0x01 0x00 

    CLA: 0x00 # Single command, No SM, channel 0.

    INS: 0xA4 # Select.

    P1:  0x04 # Select by DF name.

    P2:  0x00 # First/Only occurrence, return FCI template.

    Lc:  0x07 # 7 data bytes.

    Data: 0xD2 0x76 0x00 0x00 0x85 0x01 0x01 #???

    Le:  0x00 # Any length response.
ctag
  • 574
  • 2
  • 4
  • 15
  • I've stumbled across a related question; slowly piecing it together. http://stackoverflow.com/a/23180223/1349825 – ctag Sep 13 '16 at 04:08
  • This C file has -- what looks like -- a pretty good description of the CC file on line 229. I can't find the format/layout detailed anywhere else. https://github.com/nfc-tools/libfreefare/blob/master/examples/mifare-desfire-create-ndef.c – ctag Sep 13 '16 at 04:36

1 Answers1

0

Furthermore, I don't know how to interpret the initial command [E080] from the phone.

I can point you at some starting points. E080 is part of RATS (Request for Answer To Select). Secion 5.9.2 (Rats command and ATS response) of this pdf (https://www.st.com/resource/en/datasheet/st25ta64k.pdf) breaks down the 0xE0 as the INS and 0x80 as the Param, which is a bit vector.

Eric Betts
  • 471
  • 2
  • 8