Skip to content

FeliCa Emulation: Handle non-hardware Polling commands #4204

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 7 commits into
base: dev
Choose a base branch
from

Conversation

dogtopus
Copy link
Contributor

What's new

This is a continuation of #4202.

NFC TagInfo, probably all NDEF Type 3 readers, and possibly other readers rely on Polling commands with Request Code of 1 (default System Code request) and non-FFFF System Code to detect card type. The NFC controller doesn't seem to handle the latter case in hardware and simply bubbles those commands up to the firmware layer. The firmware in its current form then gets confused and interrupts the transaction, resulting in failed reading attempts.

This PR adds a handler for when a Polling command with non-FFFF System Code is seen on the firmware side, so that readers behaving like NFC TagInfo could read the emulated card without failing.

Verification

  • Use the .nfc file provided here: F.zip
  • Scan with NFC TagInfo. It should read the entire contents of the emulated card, including having the correct decoding on the NDEF tab.
  • Scan with no reader app. It should open https://example.com
  • Use Proxmark3 to send polling commands to the emulated card. It should return something similar to below:
[usb] pm3 --> hf felica raw -c 060088b40000
[+] Data: 06 00 88 B4 00 00 F7 25 
[+] (22) B2 4D 12 01 01 2E 46 65 6C 69 43 61 00 F1 00 00 00 01 43 00 D8 9F 
[usb] pm3 --> hf felica raw -c 060088b40100
[+] Data: 06 00 88 B4 01 00 C4 14 
[+] (24) B2 4D 14 01 01 2E 46 65 6C 69 43 61 00 F1 00 00 00 01 43 00 88 B4 26 1C 
[usb] pm3 --> hf felica raw -c 060088b40200
[+] Data: 06 00 88 B4 02 00 91 47 
[+] (24) B2 4D 14 01 01 2E 46 65 6C 69 43 61 00 F1 00 00 00 01 43 00 00 83 F2 99 
[usb] pm3 --> hf felica raw -c 060012fc0000
[+] Data: 06 00 12 FC 00 00 ED 1D 
[+] (22) B2 4D 12 01 01 2E 46 65 6C 69 43 61 00 F1 00 00 00 01 43 00 D8 9F 
[usb] pm3 --> hf felica raw -c 060012fc0100
[+] Data: 06 00 12 FC 01 00 DE 2C 
[+] (24) B2 4D 14 01 01 2E 46 65 6C 69 43 61 00 F1 00 00 00 01 43 00 12 FC 18 F0 
[usb] pm3 --> hf felica raw -c 060012fc0200
[+] Data: 06 00 12 FC 02 00 8B 7F 
[+] (24) B2 4D 14 01 01 2E 46 65 6C 69 43 61 00 F1 00 00 00 01 43 00 00 83 F2 99

Checklist (For Reviewer)

  • PR has description of feature/bug or link to Confluence/Jira task
  • Description contains actions to verify feature/bugfix
  • I've built this code, uploaded it to the device and verified feature/bugfix

NFC TagInfo and possibly other readers rely on Polling commands with Request Code of 1 (default System Code request) or non-FFFF System Code to detect card type. Since the NFC controller doesn't seem to handle them in hardware and simply bubbles them up, and then the Flipper firmware will just ignore them and refuse to respond afterwards, this causes the reading operation to fail.

This commit adds a simple handler for such Polling commands so that readers behaving like NFC TagInfo could read the emulated card without failing.
The NFC controller should handle Polling commands with the System Code set to FFFF, so it's not necessary for the firmware to handle it.
We already have enough information to determine whether or not the card supports NDEF since SYS_OP register value is included in all current Lite-S card dumps.
This allows the reader to specifically select the service by naming the Service Code.
@hedger hedger added the NFC NFC-related label Apr 26, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
NFC NFC-related
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants