Search code examples
androidnfcmifare

Writing with Mifare Ultralight in Android - Memory locked?


I've a problem writing data to a Mifare Ultralight C tag. I can read it and write in part of the memory, but it seems that part of it is blocked and it shows me a IOException "Transceive failed". I can't write memory positions 14-27. It doesn't seem that the blocks are locked. The first time that i wrote something, it worked just fine, but now i can't even format the tag to Ndef.

I'm using the method

ultralight.writePage(pageOffset, data);

I can't upload images, but hope this helps describing the problem better (info taken from TagInfo app):

ATQA 0x4400
SAK 0x00
Memory content:
00 * 04:4F:BD 7E (UID0-UID2, BCC0)
01 * 5A:53:28:80 (UID3-UID6)
02 . A1 48 00:00 (BCC1, INT, LOCK0-LOCK1)
03 . E1:10:12:00 (OTP0-OTP3)
04-OF . DATA
10-27 ? DATA
28 ?p XX XX -- -- (LOCK2-LOCK3)
29 ?p XX XX -- -- (CNT0-CNT1)
2A ?p 28 -- -- -- (AUTH0)
2B ?p XX -- -- -- (AUTH1)
2C ?- XX XX XX XX
2D ?- XX XX XX XX
2E ?- XX XX XX XX
2F ?- XX XX XX XX

Any ideas?

Thanks


Solution

  • The lock bytes for pages 0x10 and beyond are inaccessible, so it is hard to tell for sure what is going on if you don't know the authentication key. What you probably did is overwrite page 0x28 and beyond the first time you wrote data, thereby locking pages 0x14-0x27 by accident (and perhaps setting a password). Once a page is locked, you cannot unlock it anymore, unfortunately.