Search code examples
formatnfcmifarendeftlv

How do I read a record's payload from an NXP MIFARE Ultralight tag?

I've got a couple of NXP MIFARE Ultralight tags (type 2) that contain some data in the first record. I'm using an ACS 1252U to read the tags, and I've tried manually iterating over some of the data to get a sense of what's on the tag, but I can't seem to figure out how to determine where the record begins and where it ends.

Here's some detailed information on the NFC tag and the record I'm trying to read:

And here's some data from one of my tags starting at page 04:

03 ff 01 5a
c4 0f 00 00
01 45 62 63
61 72 64 2e
6e 65 74 3a
62 63 61 72
64 39 39 37
30 31 1e 34

Now if I convert all of that to ASCII, I get the following:

ÿZÄEbcard.net:bcard997014

All I know is that the actual data I'm after (or the payload) begins at 99701, but how in the world am I supposed to know that? Surely there's something in the data that can tell me where the record's payload starts and where it stops?

Solution

  • The data follows the Type 2 Tag specification just fine. A Type 2 tag has its data pages starting at page/block 4. Data is embedded into TLV structures.

    In your case, the first byte of page 4 is the tag of an NDEF Message TLV (0x03). The next byte indicates that the length filed is encoded in 3-byte format. Consequently, the length is 0x015A (= 346 bytes). Thus, you have to read the next 87 pages (= ceil(346/4) since data starts at page boundary) to retrieve the complete NDEF message.

    The NDEF message itself consists of 1 NDEF record (the header byte 0xC4 indicates that the record is the first (MB=1) and last (ME=1) record of the message). The record is an NFC Forum external type (TNF=4 in the header byte). The type name has a length of 0x0F (= 15 bytes). The payload has a length of 0x0145 (= 325 bytes). Consequently, the type name is "bcard.net:bcard" and the payload is '39 39 37 30 31 1E 34 ...' (ITN doesn't seem to have published a specification on how their bcard type is structured).

    See How to interpret NDEF content on Mifare Classic 1K on how to decode these TLV structures and the NDEF message.