Emulate Mifare card with Android 4.4

by

With host-based card emulation (HCE) in Android 4.4 you can only emulate the ISO/IEC 14443-4 protocol. More specifically you can only emulate application structures according to ISO/IEC 7816-4 (thus card emulation applications need to be selected though an AID). Moreover, the API doesn’t give you any means to specify if card emulation should be done using Type A or Type B protocol.

So regarding emulation of various MIFARE protocols:

  • MIFARE Ultralight (and derivates) protocol operates on top of ISO/IEC 14443-3. It is not possible to emulate cards using such low layer protocols using Android HCE.
  • MIFARE Classic protocol partially operates on top of ISO/IEC 14443-3 (with some different framing). Thus, its also not possible to emulate MIFARE Classic using Android HCE.

  • MIFARE DESFire protocols operate on top of ISO/IEC 14443-4. There are three variants of the DESFire protocol:

    1. native protocol: As this protocol does not use APDUs according to ISO/IEC 7816-4 its not possible to emulate it using Android HCE.
    2. wrapped native protocol: This protocol uses APDUs according to ISO/IEC 7816-4, however, readers will typically not issue a SELECT command using the DESFire AID when starting to communicate with a card in wrapped native command mode. (Note: Newer reader implementations are more likely to issue a SELECT command that is compatible with Android HCE as this is also required for some of NXP’s newer smartcard products with DESFire protocol emulation.)
    3. ISO protocol: This protocol is based on ISO/IEC 7816-4 and uses application selection by AID. Thus, it may be possible to emulate this protocol using Android HCE.

    Some readers may require certain parameter values in lower protocol layers (such as a specific UID cascade-level, a certain ATQA value, a certain SAK value, or a certain ATS). Android HCE does not have any means to set these values. See Editing Functionality of Host Card Emulation in Android for a possible approach to modify those values on certain rooted devices and my answer to Host-based Card Emulation with Fixed Card ID for a strategy to programatically change those values in a custom ROM.

A note on the HCE feature available in CyanogenMod from version 9.1 to version 10.2: This will emulate any ISO/IEC 14443-4 based protocol without the requirement for an application structure according to ISO/IEC 7816-4. You can even choose if you want to emulate Type A or Type B protocol. So it should be possible (though I haven’t tested) to emulate any of the three DESFire protocols. However, even with the HCE feature of CyanogenMod it is not possible to emulate MIFARE Ultralight or Classic protocols. Moreover, it’s also not possible to influence low-level protocol parameters such as a UID, ATQA, SAK, or ATS.

More Related Contents:

  1. Host-based Card Emulation with Fixed Card ID
  2. Editing Functionality of Host Card Emulation in Android
  3. Get Static NFC Tag Id with HCE mode
  4. Android app enable NFC only for one Activity
  5. Bluetooth pairing without user confirmation
  6. Getting started with Open NFC emulator
  7. Get NFC tag with NDEF Android Application Record (AAR)
  8. Android: Changing NFC settings (on/off) programmatically
  9. NTAG212 Mifare Ultralight with Authentication
  10. How to prevent NFC tag cloning?
  11. Locking mechanism of Mifare Classic 1K
  12. Secure element Access Control on ICS 4.0.4
  13. JSON parsing in android
  14. Code not working in onPostExecute function
  15. ImageView in circular through XML
  16. How to send a SMS using SMSmanager in Dual SIM mobile?
  17. java.lang.NoClassDefFoundError: javax.activation.DataHandler in android
  18. Android Emulator Error Message: “PANIC: Missing emulator engine program for ‘x86’ CPUS.”
  19. How to browse localhost on Android device?
  20. Expandable list with RecyclerView?
  21. Error inflating class and android.support.v7.widget.CardView
  22. How to programmatically get the list of registered users in Firebase [duplicate]
  23. Android ViewPager get the current View
  24. How do you check if music is playing by using a broadcast receiver?
  25. Android – Adding at least one Activity with an ACTION-VIEW intent-filter after Updating SDK version 23
  26. custom dialog with close button
  27. Android Hello-World compile error: Intellij cannot find aapt
  28. Implications of Android multiple user support (new in 4.2) for server side data model (e.g. android_id)
  29. Android change layout dynamically
  30. Recycling views in a listview, worth it?

Leave a Comment