Mifare Ultralight C authentication

Question

I am working with NFC tags (Mifare Ultralight C) but I have problems with authentication.

If I understand correctly on page 42 should be information about restricted pages. There is value 04d83460 so pages 4+ should require authentication?

On page 43 value is 4a402b80. Why there is such a value and what that means?

I can write and read to pages 4-40 but if I try to write pages 41+ nothing happens.

EDIT:

MifareUltralight mifare = MifareUltralight.get(tag);
        if(mifare == null){
            Log.e(LOG, "mifare null");
        } else {
            Log.e(LOG, "mifare not null");
            switch(mifare.getType()){
            case MifareUltralight.TYPE_ULTRALIGHT:
                Log.e(LOG, "ultralight");
                break;
            case MifareUltralight.TYPE_ULTRALIGHT_C:
                Log.e(LOG, "ultralight c");
                break;
            case MifareUltralight.TYPE_UNKNOWN:
                Log.e(LOG, "type unknown");
                break;
            }
        }


        try {
            mifare.connect();
            mifare.writePage(39, new byte[]{0x10, 0x02, 0x02, 0x02});

            Log.e(LOG, "read");

            byte[] resp = mifare.readPages(40);

            for(byte b : resp){
                Log.e(LOG, "resp: " + b);
            }



            mifare.close();
        } catch (IOException e1) {
            e1.printStackTrace();
        }

Answer 1

The tag does not seem to be a MIFARE Ultralight C tag. Instead it seems that this is a tag with 42 pages (this could be, for instance an NTAG203).

The first indication for this is the value that you read from page 42: 04d83460. This looks like the start of the UID including BCC0. 0x04 looks like the manufacturer ID of NXP. Moreover, the value 0x60 would be a valid BCC0 for 0x88 (cascade tag) XOR 0x04 XOR 0xD8 XOR 0x34. Therefore, this could be a valid value of page 0.

The second indication for this is the way how you read those pages:

byte[] resp = mifare.readPages(40);

With this line you read four pages starting from page 40. If the memory area is smaller than 44 pages, this command will roll over to the start of the memory area. Hence, if the memory area consists of 42 pages, this command will return pages 40, 41, 0, and 1. Consequently, what you interpret as pages 42 and 43 are actually pages 0 and 1.

The only strange thing about this is that your page 2 contains the value 6f480000. If page 1 contained 4a402b80 (the remaining UID), then the first byte of page 2 (BCC1) should be 0x4A XOR 0x40 XOR 0x2B XOR 0x80 = 0xA1 and not 0x6F.