yashsingh1/xdaforums huggingface dataset:
[NFC Hacking] okz19:
card emulation

try NFClassic.apk its in the android market, i cannot confirm it works but it appears to and i will test it tomorrow, it recognises my work card it picks up 2 tags, one will be door access and the other is canteen credit, (the app doesnt tell you this, but i know there 2 parts to the card, as i recently cancelled a card then found it, and can no longer access doors with it, but can still use it in the canteen) anyway the app reads the card and asks if you want to save the info, save it, the you will see it under saved tags click the tag, and click share tag, it then appears to emulate the tag as a card so it can be read by a nfc card reader, but i dont have a reader to confirm this, but i will try it tomorrow night at work to see if the doors accept it, ill let you know my results

and if anyone else know of any apps that can definatley emulate cards on galaxy s 3 let me know ! the more software i can try at work the more likely ill find one that works, i only got my s3 yesterday and have been of work so havnt tested any app, but NFClassic is the only one that appears to emulate my card.

note the app cannot write cards, only has options to write contact to card but when tried it force closes. i would definatly like to be able to write to card if at all possible ( free lunch :P copy card when it has credit , when run out of credit, re-write info = credit again :) its gotta be possible somehow ! )
[NFC Hacking] LoveNFC:
You can try, but it's probably not going to work.
[NFC Hacking] ascsa:
NFC ReTag can´t do that ... but a lot of other cool stuff :D
[NFC Hacking] azy141:
I tried nfclassic and that didn't work I'm also looking for NFC card emulation
[NFC Hacking] freerein100:
I'm not sure about other phones but Evo4GLTE's have Android beam that should do what is wanted
[NFC Hacking] nokios:
This didn't even occur to me til I saw this thread. I will be trying with my work badge since I occasionally forget mine as well...

I am still deciding between getting the S3 and the EVO 4G LTE. Leaning towards evo... but haven't played with the s3 yet.
[NFC Hacking] Nizda1:
I don't have your HTC, although there's documented info for the nexus s where devs were successful in emulating mifare most of the code is still on dev android. Its not full reigns of emulation but depending on your level of tech you can do some pretty cool stuff. I don't know how far this has gone but I remember people getting some functionality on new galaxy. Check out the link.

http://techshek4u.blogspot.com/2012/01/applying-card-emulation-patch-to_03.html
[NFC Hacking] Zanith:
How does google wallet do it? Doesn't that emulate a secure card?
[NFC Hacking] duqueso:
I was thinking the same thing!

The most "advanced" operations that i was able to do with the Galaxy Nexus were saving actions with differents cards. But that's all.

By the way, i use NFC ReTag to achieve it.
[NFC Hacking] Nizda1:
What I was just referring to was emulation how I perceived the op was looking for. Example you use a card at work to open a door and wanted to emulate that so you could use your phone instead. However with gwallet or say paywave then you'd need to have the secure key which obviously wouldn't just be given out otherwise you would be able to emulate anyone's card. Hence the secure element. Then it would be ridiculously insecure. Ex. If I took a friends paywave and was able to emulate it then now I in theory just stole their credit card :). It's also why gwallet won't work without a secure element like on my sgs2.
[NFC Hacking] TNIxeye:
WOW interesting topic

anyone trythis

ive seen the video after flashing and kinda dissapointed

bcos they cannot prove that nexus s can be the nfc tag anyway they donk have the reader too to test it
[NFC Hacking] hayashiyuuzen:
Hmmm...

Hey guys.. i went searching in the marketplace for an app that does just that (emulate a RFID)...

And... I FOUND ONE!It's called NFC Classic Tag Reader

It was able to read my cards and apparently emulate it but i have no idea if it works cause my door does not detect it... and i have no other NFC devices...

I'm using a SHS-5120 door lock... and that only registers the serial no of the tags programmed and allows only those to enter...

Read on the comments that ICS users are not getting it to work but previous 2.3.3 user reviewed that it was working like a charm...

Oh and i'm using a S3... which of course is ICS...
[NFC Hacking] fordiy:
I reckoned Google Wallet will store something into the mobile NFC chip. Make the phone like a RFID card or tag.

I also noticed some Korean telecom operators has their apps integrated on the Android phones which have the Membership card, Voucher, Credit card etc. functionality. That means the NFC enabled phone can be acted as RFID card or tag.

Is there anyone know where we can find the source code sample from Google development website we could look into this kind of project?
[NFC Hacking] SimonCraddock:
We have HID sensors on doors at work as well as a clocking in system and both use different cards so I'm going to have a go with them on Monday with my SGS3.
[NFC Hacking] grzesiok:
any luck with doors? :)
[NFC Hacking] nfc_:
Anyone any luck with being able to push/publish his phone as a card? Like for instance with doors?

We have Mifare Classic cards which open doors, reading the card isn't a problem, but being able to emulate your phone as a card has proven to be more difficult..

How does one turn his phone into 'beacon mode' (being able to receive the door's power boost and return card info) ?
[NFC Hacking] Eroo:
I took a "backup" of my tag using NFC TagInfo (saved to .xml).

Anyone one how to get it back? (used some NFC writer that wrote some URL to my tag when I pressed write to tag, thought I get to choose what to write) :crying:
[NFC Hacking] seamonkey420:
tried this w/my card and no luck reading it w/several nfc apps. however, the door reader will beep when i try my phone on it. so i think door readers use a different frequency for security. makes sense.
[NFC Hacking] LoveNFC:
If they were operating at a different frequency then your phone likely wouldn't be recognised.

None of you will get your phones to open your doors. Google have not provided access to card emulation mode, so there's nothing for the door readers to read. Somebody here on XDA claimed that they wrote an application to send NDEF messages containing the data on their access cards and that this worked for doors etc, but they didn't share this app so I'm not sure how true that is.
[NFC Hacking] Bardamuz:
the guy have made the app's have share it with some people and it work but only on rooted devices.
[NFC Hacking] Fredro:
Google Wallet has access to embedded Secure Elements, and therefore it is allowed to emulate a card.

The only thing you can do now is make the phone share a NDEF message to other readers which is not that useful.

So for this to work you have to get access to the Secure Elements with hidden API + patch some stuff in the source and make a custom rom.
[NFC Hacking] wackyD:
What I'm going to try is get security at where I work (they do all the access cards and all) and see if they'll be willing to program the NFC chip in the phone. To provide access to a card they program it and swipe against a writer. Going to see if they can do that. Flaws in logic?
[NFC Hacking] fordiy:
Developers can access the embedded secure element with the classes

Developers can access the embedded secure element with the classes in the package com.android.nfc_extras, especially the NfcAdapterExtras.java and NfcExecutionEnvironment.java.

But still don't know how to proceed to card emulation with that classes file.
[NFC Hacking] sodeknetters:
definately not going to work. Your phone may be able to read the write command, and save this as a file, or whatever. But you will need a different approach if you want to actually emulate the card.
[NFC Hacking] nfc_:
What if you run something like this on your phone (of possible at all..) <URL removed since I'm new and not allowed to post URLs yet... hxxp://openpcd.org/Live_RFID_Hacking_System> ?

Will that OS be able to use the phones hardware as a RFID/NFC writer, and thus be able to emulate a card?
[NFC Hacking] RedGreenGeek:
I have some insight how access systems work. Nothing but the tag serial number is usually used. Simply a cards NFC serial is attached to a user profile, which then allows different access rights like times and place, doors point... Some use cards to log door entries, esp. if reader is on the door like in a hotel room.

It would be insane to allow phones to emulate this, then everybody would ride the train for free, enter storage areas with other ppl's tag etc.

The best option is to buy a NFC chip that suits you, and have security add the chip you have chosen to the system, rather than the card you use.

(the cantina money might be stored on the memory, which security usually do not use anyhow) You might be able to recharge this yourself if you get a card r/w for your PC. Depends how pro the cantina solution is.
[NFC Hacking] heardamir:
I thought that you needed the key in order to read all of the sectors & blocks. So, there is a key exchange between the card and reader meaning that it is a lot harder to copy the card entirely, leaving it somewhat useless.
[NFC Hacking] nfc_:
How is that different from copying the Mifare Classic card to a new card?

Since the NFC is able to write to the tags and thus write out info, why wouldn't it be able to write to for instance a card reader.

The free train rides are already happening widely, and every 'fake' card is being banned instantly, but since you're already on the transport of choice it doesn't matter anymore. You just don't want to walk into a control check/sweep :)

Correct me if I'm wrong, since I'm really new to this NFC and phone hacking in general, but if the OS of the phone supports NFC output, it really should be possible to emulate a card, right?
[NFC Hacking] LoveNFC:
This is false. These systems are based on the UID of the NFC card. The vast majority of access systems for schools and places of work don't write anything onto the card. They simply make an association in their backend system with that person's user account and the UID of their NFC card.

Because of this, it is indeed possible to get your phone's NFC chip associated with your account instead of a NFC card. However, the issue with Android is that your phone generates a random UID with each NFC interaction. This means that, once the security guy swipes your phone to associate it with your account, the UID will change the next time you swipe it. The only way to fix this and get a static UID would be to enable card emulation. This was done in the Nexus S with custom firmware a while ago, but has not been repeated on any other phones. If you are able to enable card emulation, your phone will emulate a generic Mifare NFC card with a static UID, and you would then be able to replace your door access card with your phone (in most cases).

Phones can't emulate specific UIDs, not because of software limitations, but because of hardware. There are other solutions out there, such as the Proxmark 3, which allows UID cloning. The Proxmark 3 makes it very easy to clone school, university and place of work access cards, as most of these rely purely on UID association.

Here in England, trains, buses etc don't work with the system you've described, and I'd imagine it's the same for most other countries. The data (money stored, top-ups, money deducted) is written to the card in real time. Of course these types of cards have higher levels of security through the use of secret access keys. Without access to these secret access keys, you can't dump the data from an Oyster card, for example. You therefore cannot simply duplicate an Oyster card with your phone, unless the issuer provides you with the access keys or you manage to crack them on your own.
[NFC Hacking] fordiy:
depicip agreeable

Well comments from LoveNFC. I have no idea why sensitive data need to store to the card? Why the authentication need to go through the SE, not from the server-end? Why not just emulate the UID with blank empty card?
[NFC Hacking] nfc_:
I've been trying for quite some time now to see where I'd get stuck.

My scenario: Touch-a-tag NFC reader (usb) on a laptop with BackTrack 5R2, within 20 minutes I had the NFC working, and 10 minutes later I succesfully copied/cracked a Mifare Classic card.

Since the guide I was following proved to be working, I just tried to do the exact same on the S3, with the 'Complete Linux installer' app and a Backtrackv8.img file as LiveOS.

I ran into a lot of compatibility errors, for instance the ARM apt repository isnt as filled/complete as the x86/x64 one, a lot of aps need to be cross compiled by hand, however I got those working.

The driver for the NFC on the other hand won't f****ng compile, but then again, I might not even need it since the chipset of the Touch-a-Tag is different from the S3's NFC.

From there on it was all just getting messy and depended on usb.h (libusb) that sometimes couldn't be found and whatnot.

I don't think this will work from the android shell, since android seems to have limited the NFC capabilities.

Any real hacker got thoughts or would like the give it a try together?
[NFC Hacking] ThehypnooToad:
New to NFC but what kind of things can we transfer via NFC is it possible to transfer music and video is there a upload limit to transfering
[NFC Hacking] sysadmn:
Andoid Beam uses NFC to send data between two devices. 'File Expert' app claims to be able to use NFC to transfer files. It seems to me that part of the reason for NFC standards to define the type of info to be shared. There doesn't seem to be a 'generic' data type, or a profile for file transfer (as with bluetooth).

Speaking of which, there's a cool app (Blue NFC) that uses NFC to setup a bluetooth connection to transfer the files - pretty slick.
[NFC Hacking] Fredro:
This is going to be hard to get the various libs in arm format. Especially the libnfc and other nfc specific libs. But this is only needed if you really want a certain program to run, but you can always do some heavy work with a read reader on the pc and make an app on the phone to do other stuff not needing such programs.
[NFC Hacking] electronixtar:
So according to this thread, NFC card emulation only works

1. Galaxy S series with 2.3 ROM.

2. Nexus S with hacked firmware.

:mad:
[NFC Hacking] Damastus:
Has anyone been able to use card emulation via OpenNFC? I know this was answered at the beginning of the thread, but that was quite a while ago. It's still utterly confusing on their webpage. They still don't give out examples for the card emulation mode and don't give any useful information regarding requirements for it to be used.

As far as I get their approach they try to use only the NFC antenna and the operating system. The secure elements are completly excluded from it (or lets say, access to them is not required to use the mode).

I'd appreciate an answer if someone was actually able to use it.
[NFC Hacking] nfc_:
Yeah, I found that out the hard way, it's all fun and games until the point where something isn't ARM compatible, and the sourcecode won't compile as well.

Besides, I really doubt that there is a NFC driver out there for ARM that isn't limited (ie: no writing/emulating) by Google/Android.

Although I was amazed how far I came, nearly all programs except the USB driver and some other dependicy.

Did anyone ever ran Linux from the core of the phone? Not booting an ISO within Android, but really install Linux on the phone?
[NFC Hacking] poussinvert:
Hi everybody

What about that ?
[NFC Hacking] Damastus:
Great library If you have access to a secure element. Useless otherwise. All this does is provide a NFC Secure Element stack and API in order to communicate with it. It`s only useful to you if you can actually install your own app on the secure element and want to communicate with it by sending APDUs.
[NFC Hacking] Nizda1:
Check out adafruit's new nfc Breakout board. I use it with a ras pi or you could use arduino but the point is ras pi Im using arm archlinux, I got libnfc for PN532 and UART configured and r/w . Gwallet is another story for obvious reasons, but if you really wanna dig into nfc check it out.
[NFC Hacking] poussinvert:
Ok, thank you for your explanations.

I am not an expert in android and nfc, but this subject really interest me...
[NFC Hacking] nelsonw:
would be nice to use the phone as work badge. tryied all tips here. nothing works...
[NFC Hacking] flflfl:
Where can I find this app?
[NFC Hacking] rayzzz:
Nickolay Elenkov (Sorry, can't post outgoing links yet: nelenkov.blogspot.nl/2012/10/emulating-pki-smart-card-with-cm91.html) has a detailed article on his blog about how to make an app with card emulation on Cyanogenmod 9.1 (he claims cm10 works as well). I haven't got it working yet, but this might have something to do with the drivers of my reader.
[NFC Hacking] Robbilie:
anybody having 2 nfc phones habing tried to simulate a mcfit membercard? since its claimed to use the default key, copying the complete ta might be easier...?nelenkov.blogspot.nl/2012/10/emulating-pki-smart-card-with-cm91.html

//Robert ;)
[NFC Hacking] Damastus:
If I remember right, that McFit card was a Mifare Classic? Then its just not possible to emulate it. Only way to emulate it is to read the content, root a Nexus S with Mortadellos patch (I guess you could find that somewhere in here) and write the previously read content with an external reader onto the Mifare part of the SmartMX. You cannot use CyanogenMod for that. CM can only (well, at least it can do that, which is a big step forward) emulate basic ISO 14443 A & B compliant cards. Mifare Classic is ISO 14443-3 A.
[NFC Hacking] Robbilie:
you are right, its a mifare classic...

some nfc readers tell me the nfc tag in the mcfit card is empty, other tell me only the first block is written with the defaul key ( yeah they are stupid i know... ) and nfc classic app tells me it is emulating the nfc tag from the mcfit card when i press emulate... running a motorola razr i, doesnt even now what chip is in it...nxp?

havent tested if its really emulating since i dont have annother nfc device...
[NFC Hacking] DVDL16:
Any of you gyus have experience with Arduino?

Would say an

NFC Shield

coupled with an Arduino microcontroller detect an NFC enabled phone, and complete actions based on the detection of a specific phone. Or does this NFC Shield also rely on a static UID, as LoveNFC mentioned?
[NFC Hacking] SamsungPisser:
As far as I know the NFC specification is especially designed that you can use every device as tag. It seems that this has been disabled in kernel, but it should be possible to enable it on all NFC capable phones.
[NFC Hacking] Damastus:
Number 1) No its not possible on all phones, but I wont go further into that

Number 2) Even if enabled, you as a third party can't do anything

Number 3) Card Emulation is specified as optional
[NFC Hacking] SamsungPisser:
Could you explain it futher why I can't use that feature? I thought changing like described here http://techshek4u.blogspot.de/2012/01/applying-card-emulation-patch-to_03.html would enable it and enable that the App NFCClassic can emulate a card.
[NFC Hacking] Damastus:
Because card emulation is done via the secure hardware module inside the phone. You don't have the keys for it. Only thing you can do is what mortadello did and get a static UID from the mifare classic that is emulated by the chip. If that is sufficient to your needs so may it be then. This works only on the nexus s.

Other idea is to check cyanogenmod out. They claim to be able to fully emulate iso 14443 A/B emulation which does not seem to work that well either.
[NFC Hacking] vanillapuff:
I have like a wireless key card and I am sure its NFC tag. Is there a way for my phone to replace the card. I know about Google wallet, but doesn't seem to be what I want. Anyone in the same situation?
[NFC Hacking] SamsungPisser:
The secure element can also be software. Of course it is not as secure, but that doesn't matter.

Here http://www.sit.fraunhofer.de/en/fields-of-expertise/projects/sharekey.html is a project to use your phone as key. So card emulation should be possible.
[NFC Hacking] Damastus:
Yes it can be software. Doesnt change the fact that emulation is done via hardware currently.
[NFC Hacking] Robertjee:
I think most of the cards are secured...
[NFC Hacking] knox2000:
According this video Mifare isn't secure and can be emulated. If it's possible on an android phone is an other question.

[YOUTUBE]QJyxUvMGLr0[/YOUTUBE]
[NFC Hacking] shane_filan:
I tried nfclassic and that didn't work I'm also looking for NFC card emulation
[NFC Hacking] kr@w:
HID scanners

I just wanted to weigh in and let everyone know that I do the security at my work and I was successfully able to get the Nexus 4 to be scanned by the HID scanner. It passed an ID back to the access control and I was able to set it up under my profile. I can now gain access with my phone to the same places as my badge. I tried to do the same on a Samsung Galaxy S III and it generated a random "ID" for the access control server and I wasn't able to set it up.

-Kr@w

-UPDATE:

I was also successful setting it up for a EVO 4g LTE. This is big since the Nexus 4 uses a Broadcom chip and the EVO 4g LTE uses a NXP chip as far as I can tell. This in my mind points to it possibly being software that causes a random id each time. Just my 2 cents.
[NFC Hacking] DVDL16:
Wow that is great news kr@w, especially the fact that you succeeded in setting it up for the EVO 4G LTE! How difficult was the software implementation?
[NFC Hacking] LoveNFC:
What ROM/kernel etc are you using on the Nexus 4? Basically, what's the configuration of your devices?

And are you using an application, or just passing your phone over the reader from the homescreen?
[NFC Hacking] ascsa:
Hmm, congrats!

But as a security guy, I would be seriously concerned if my access control system is purely based on the UID....

(--> there are some Chinese mifare clones with a changeable UID out in the wild ....)
[NFC Hacking] LoveNFC:
Perhaps, but that's how many, many schools and places of work do it.
[NFC Hacking] ascsa:
Yep, there are a lot of poorly implemented solutions out there ... not only implementations based purely on the UID, but also based on the mifare crypto1 "encryption algorithm" (-> hacked 2008!) ...However, I wouldn´t rely on such an implementation ....:eek: