[NFC Hacking] madfish73:
GalaxyNexus AOKP kitkat 4.4.2 Nfc.apk mod

Since xposed can not run in Kitkat ART mode, so I have to mod the Nfc.apk again.

1. This mod is compatible with Tasker intent receiving.

2. It sends Intent pk.qwerty12.nfclockscreenoffenabler.TAG_DISCOVERED_XXXXX(Tag ID) when tag discovered

3. it sends Intent pk.qwerty12.nfclockscreenoffenabler.TAG_LOST_XXXXX when tag lost

4. and, also, it enable Nfc polling in ScreenOff state.

To receive the Intent in Tasker:

Tasker->Profiles->add->Event->System->Intent Received->Action: pk.qwerty12.nfclockscreenoffenabler.TAG_DISCOVERED_XXXXX(Tag ID)

To simplify the mod, I don't add "Tag Lost Sound" to it at this time.

This mod has been tested in my Galaxy Nexus with AOKP kitkat 4.4.2, download the mod: View attachment Nfc.apk

The following is the detail of mod, it should work for others phone, and it's only the step of smali file modification. To mod the apk, you must have some knowledge of apk mod(etc. the usage of apktool, baksmali, winrar...)

*****************************************************

* Modify File1: NfcService.smali

*****************************************************

=========1. add variable declaration

#++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

#qlg 20140313

#

.field mApplyRouting:I

.field public static sContext:Landroid/content/Context;

#------------------------------------------------------------------

...

=========2. modify class NfcService constructor

.method public constructor <init>(Landroid/app/Application;)V

.locals xxxxxxxxxxxxx

#++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

#qlg 20140313 mApplyRouting = 0x0, sContext = Application

#

const/4 v0, 0x0

iput v0, p0, Lcom/android/nfc/NfcService;->mApplyRouting:I

sput-object p1, Lcom/android/nfc/NfcService;->sContext:Landroid/content/Context;

#------------------------------------------------------------------

...

=========3. modify method applyRouting

.method applyRouting

.locals 7

#++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

#qlg 20140313 set mApplyRouting=0x01, mScreenState=0x3 (SCREEN_STATE_ON_UNLOCKED)

#

const/4 v1, 0x1

iput v1, p0, Lcom/android/nfc/NfcService;->mApplyRouting:I

const/4 v1, 0x3

iput v1, p0, Lcom/android/nfc/NfcService;->mScreenState:I

#------------------------------------------------------------------

...

:cond_0

monitor-exit p0

:goto_0

#++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

#qlg 20140313 set mApplyRouting=0x0, mScreenState = checkScreenState();

#

const/4 v0, 0x0

iput v0, p0, Lcom/android/nfc/NfcService;->mApplyRouting:I

invoke-virtual {p0}, Lcom/android/nfc/NfcService;->checkScreenState()I

move-result v0

iput v0, p0, Lcom/android/nfc/NfcService;->mScreenState:I

#------------------------------------------------------------------

return-void

...

...

...

.end method

=========4. modify method checkScreenState

.method checkScreenState()I

.locals 1

#++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

#qlg 20140313 if (mApplyRouting ) return mScreenState

#

iget v0, p0, Lcom/android/nfc/NfcService;->mApplyRouting:I

if-eqz v0, :cond_continue

iget v0, p0, Lcom/android/nfc/NfcService;->mScreenState:I

goto :goto_0

:cond_continue

#------------------------------------------------------------------

...

=========5. modify method onRemoteEndpointDiscovered

.method public onRemoteEndpointDiscovered(Lcom/android/nfc/DeviceHost$TagEndpoint;)V

.locals 1

.param p1, "tag" # Lcom/android/nfc/DeviceHost$TagEndpoint;

.prologue

.line 313

const/4 v0, 0x0

invoke-virtual {p0, v0, p1}, Lcom/android/nfc/NfcService;->sendMessage(ILjava/lang/Object;)V

#++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

#qlg 20140313 sendTagDiscoveredMessage(tag)

invoke-virtual {p0, p1}, Lcom/android/nfc/NfcService;->sendTagDiscoveredMessage(Lcom/android/nfc/DeviceHost$TagEndpoint;)V

#------------------------------------------------------------------

.line 314

return-void

.end method

=========6. add method byteArrayToHexString

#++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

#qlg 20140313

#	// Converting byte[] to hex string, used to convert NFC UUID to String

#	public static String byteArrayToHexString(byte [] inarray) {

#	int i, j, in;

#	String [] hex = {"0","1","2","3","4","5","6","7","8","9","A","B","C","D","E","F"};

#	String out= "";

#

#	for (j = 0 ; j < inarray.length ; ++j) {

#	in = (int) inarray[j] & 0xff;

#	i = (in >> 4) & 0x0f;

#	out += hex;

#	i = in & 0x0f;

#	out += hex;

#	}

#	return out;

#	}

.method public static byteArrayToHexString([B)Ljava/lang/String;

.locals 7

.param p0 # [B

const/16 v5, 0x10

new-array v0, v5, [Ljava/lang/String;

const/4 v5, 0x0

const-string v6, "0"

aput-object v6, v0, v5

const/4 v5, 0x1

const-string v6, "1"

aput-object v6, v0, v5

const/4 v5, 0x2

const-string v6, "2"

aput-object v6, v0, v5

const/4 v5, 0x3

const-string v6, "3"

aput-object v6, v0, v5

const/4 v5, 0x4

const-string v6, "4"

aput-object v6, v0, v5

const/4 v5, 0x5

const-string v6, "5"

aput-object v6, v0, v5

const/4 v5, 0x6

const-string v6, "6"

aput-object v6, v0, v5

const/4 v5, 0x7

const-string v6, "7"

aput-object v6, v0, v5

const/16 v5, 0x8

const-string v6, "8"

aput-object v6, v0, v5

const/16 v5, 0x9

const-string v6, "9"

aput-object v6, v0, v5

const/16 v5, 0xa

const-string v6, "A"

aput-object v6, v0, v5

const/16 v5, 0xb

const-string v6, "B"

aput-object v6, v0, v5

const/16 v5, 0xc

const-string v6, "C"

aput-object v6, v0, v5

const/16 v5, 0xd

const-string v6, "D"

aput-object v6, v0, v5

const/16 v5, 0xe

const-string v6, "E"

aput-object v6, v0, v5

const/16 v5, 0xf

const-string v6, "F"

aput-object v6, v0, v5

const-string v4, ""

const/4 v3, 0x0

:goto_0

array-length v5, p0

if-lt v3, v5, :cond_0

return-object v4

:cond_0

aget-byte v5, p0, v3

and-int/lit16 v2, v5, 0xff

shr-int/lit8 v5, v2, 0x4

and-int/lit8 v1, v5, 0xf

new-instance v5, Ljava/lang/StringBuilder;

invoke-static {v4}, Ljava/lang/String;->valueOf(Ljava/lang/Object;)Ljava/lang/String;

move-result-object v6

invoke-direct {v5, v6}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V

aget-object v6, v0, v1

invoke-virtual {v5, v6}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

move-result-object v5

invoke-virtual {v5}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

move-result-object v4

and-int/lit8 v1, v2, 0xf

new-instance v5, Ljava/lang/StringBuilder;

invoke-static {v4}, Ljava/lang/String;->valueOf(Ljava/lang/Object;)Ljava/lang/String;

move-result-object v6

invoke-direct {v5, v6}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V

aget-object v6, v0, v1

invoke-virtual {v5, v6}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

move-result-object v5

invoke-virtual {v5}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

move-result-object v4

add-int/lit8 v3, v3, 0x1

goto :goto_0

.end method

#------------------------------------------------------------------

=========7. add method sendTagDiscoveredMessage

#++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

#qlg 20140313 sendTagDiscoveredMessage(TagEndpoint tag)

# {

#	byte[] uId = tag.getUid();

#	String uuid = byteArrayToHexString(uId).trim();

#	mContext.sendBroadcast(new Intent("pk.qwerty12.nfclockscreenoffenabler.TAG_DISCOVERED_" + uuid));

# }

.method sendTagDiscoveredMessage(Lcom/android/nfc/DeviceHost$TagEndpoint;)V

.locals 9

.param p1, "tag" # Lcom/android/nfc/DeviceHost$TagEndpoint;

invoke-interface {p1}, Lcom/android/nfc/DeviceHost$TagEndpoint;->getUid()[B

move-result-object v3

invoke-static {v3}, Lcom/android/nfc/NfcService;->byteArrayToHexString([B)Ljava/lang/String;

move-result-object v5

invoke-virtual {v5}, Ljava/lang/String;->trim()Ljava/lang/String;

move-result-object v4

sget-object v5, Lcom/android/nfc/NfcService;->sContext:Landroid/content/Context;

new-instance v6, Landroid/content/Intent;

new-instance v7, Ljava/lang/StringBuilder;

const-string v8, "pk.qwerty12.nfclockscreenoffenabler.TAG_DISCOVERED_"

invoke-direct {v7, v8}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V

invoke-virtual {v7, v4}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

move-result-object v7

invoke-virtual {v7}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

move-result-object v7

invoke-direct {v6, v7}, Landroid/content/Intent;-><init>(Ljava/lang/String;)V

invoke-virtual {v5, v6}, Landroid/content/Context;->sendBroadcast(Landroid/content/Intent;)V

return-void

.end method

#------------------------------------------------------------------

***************************************************************************************

* Modify File2: NativeNfcTag$PresenceCheckWatchdog.smali

***************************************************************************************

=========8. modify method run

.method public declared-synchronized run()V

...

const-string v0, "NativeNfcTag"

const-string v1, "Tag lost, restarting polling loop"

invoke-static {v0, v1}, Landroid/util/Log;->d(Ljava/lang/String;Ljava/lang/String;)I

iget-object v0, p0, Lcom/android/nfc/dhimpl/NativeNfcTag$PresenceCheckWatchdog;->this$0:Lcom/android/nfc/dhimpl/NativeNfcTag;

invoke-virtual {v0}, Lcom/android/nfc/dhimpl/NativeNfcTag;->doDisconnect()Z

#++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

#qlg 20140313

#

invoke-virtual {p0}, Lcom/android/nfc/dhimpl/NativeNfcTag$PresenceCheckWatchdog;->sendTagLostMessage()V

#------------------------------------------------------------------

....

.end method

=========9. add method sendTagLostMessage

#++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

#qlg 20140313

#	private void sendTagLostMessage()

#	{

#	byte[] uId = NativeNfcTag.this.getUid();

#	String uuid = NfcService.byteArrayToHexString(uId).trim();

#	mContext.sendBroadcast(new Intent("pk.qwerty12.nfclockscreenoffenabler.TAG_LOST_" + uuid));

#	}

#

.method sendTagLostMessage()V

.locals 9

iget-object v0, p0, Lcom/android/nfc/dhimpl/NativeNfcTag$PresenceCheckWatchdog;->this$0:Lcom/android/nfc/dhimpl/NativeNfcTag;

invoke-virtual {v0}, Lcom/android/nfc/dhimpl/NativeNfcTag;->getUid()[B

move-result-object v3

invoke-static {v3}, Lcom/android/nfc/NfcService;->byteArrayToHexString([B)Ljava/lang/String;

move-result-object v5

invoke-virtual {v5}, Ljava/lang/String;->trim()Ljava/lang/String;

move-result-object v4

sget-object v5, Lcom/android/nfc/NfcService;->sContext:Landroid/content/Context;

new-instance v6, Landroid/content/Intent;

new-instance v7, Ljava/lang/StringBuilder;

const-string v8, "pk.qwerty12.nfclockscreenoffenabler.TAG_LOST_"

invoke-direct {v7, v8}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V

invoke-virtual {v7, v4}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

move-result-object v7

invoke-virtual {v7}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

move-result-object v7

invoke-direct {v6, v7}, Landroid/content/Intent;-><init>(Ljava/lang/String;)V

invoke-virtual {v5, v6}, Landroid/content/Context;->sendBroadcast(Landroid/content/Intent;)V

return-void

.end method

#------------------------------------------------------------------