How to card emulate with ACR122U-A9

The ACR122U contains a PN532 NFC controller chip. The PN532 supports host card emulation through its TgInitAsTarget command (see the PN532 user manual). In order to pass commands to the PN532, you would connect to the ACR122U just as if it was a normal smartcard reader (e.g. using PC/SC). You can then send pack PN532 commands into reader-APDUs of the form

> FF000000 <Lc> <Command>

and get responses in the form

< <Response> 9000

So for getting the ACR122 into card emulation mode, you would do about the following:

  1. ReadRegister:

    > FF000000 08 D406 6305 630D 6338
    < D507 xx yy zz 9000
    
  2. Update register values:

    xx = xx | 0x004;  // CIU_TxAuto |= InitialRFOn
    yy = yy & 0x0EF;  // CIU_ManualRCV &= ~ParityDisable
    zz = zz & 0x0F7;  // CIU_Status2 &= ~MFCrypto1On
    
  3. WriteRegister:

    > FF000000 11 D408 6302 80 6303 80 6305 xx 630D yy 6338 zz
    < D509 9000
    
  4. SetParameters:

    > FF000000 03 D412 30
    < D513 9000
    
  5. TgInitAsTarget

    > FF000000 27 D48C 05 0400 123456 20 000000000000000000000000000000000000 00000000000000000000 00 00
    < D58D xx ... 9000
    

    Where xx should be equal to 0x08.

  6. Communicate using a sequence of TgGetData and TgSetData commands:

    > FF000000 02 D486
    < D587 xx <C-APDU> 9000
    

    Where xx is the status code (should be 0x00 for success) and C-APDU is the command sent from the reader.

    > FF000000 yy D48E <R-APDU>
    < D587 xx 9000
    

    Where yy is 2 + the length of the R-APDU (response) and xx is the status code (should be 0x00 for success).

Leave a Comment