Skip to main content
A
Alan L.
Visitor II
July 20, 2020
Solved

Problem of sending ACK/NAK with ST95HF in card emulation mode

  • July 20, 2020
  • 3 replies
  • 1440 views

Hi there, I'm trying to emulate an ISO/IEC 14443-3 Type A card (NXP NTAG) with ST95HF. My device can now READ data by an external card reader. The anti-collision filter(ACFILTER) has enabled for ISO/IEC 14443 Type A protocol.

According to the datasheet of NXP NTAG, writing data needs the card to return ACK to the reader:

Rdr: a2 20 1f c8 06 1f 10 de | WRITEBLOCK(32)

Tag: 0a! <- Not a full byte

I noticed that the datasheet of ST95HF describes how the chip returns ACK/NAK command in SendRecv(0x04) part.

FYI:

1. Example command of SendRecv

Example ACK

<<< 90 04 0A 24 00 00

Example NAK

<<< 90 04 00 24 00 00

2. Description of examples

90: Result code for “non-integer number of bytes are received�?

04: total length of data

0A or 00: Data

24: “2�? means no CRC, “4�? means 4 significant bits in Data byte.

00 00: No collision in response

3. Error code description of 0x90:

0x90: EUnintByte Residual bits in last byte. Useful for ACK/NAK reception of ISO/IEC 14443 Type A

4. Code (4-bit) ACK/NAK (Page 33/60 > https://www.nxp.com/docs/en/data-sheet/NTAG213_215_216.pdf)

Ah Acknowledge (ACK)

0h NAK for invalid argument (i.e. invalid page address)

1h NAK for parity or CRC error

4h NAK for invalid authentication counter overflow

5h NAK for EEPROM write error

****

The length should less than 0x01, so the question is, how can I send an ACK/NAK command by Send(0x06) command?

Thanks & regards.

    This topic has been closed for replies.
    Best answer by Alan L.

    I figured it out.

    The command "00 06 02 0A 04" doesn't work. I sniffed the communication between the reader and my ST95HF based device with a Proxmark3. It did send non-complete byte, but it wasn't 0x0A. After several attempts, I found that the command "00 06 02 A0 14" works fine.

    Although I noticed the description in the datasheet, I did not understand how it works. Thanks to your inspiration, now it works~

    THANK YOU !!!:thumbs_up:

    3 replies

    B
    Brian TIDAL
    Technical Moderator
    July 20, 2020

    Hi,

    See the format of the Send command: the last byte of the Send command contains the number of significant bits.

    06 02 0A 04 should do the job.

    Rgds

    BT

    A
    Alan L.AuthorAnswer
    Visitor II
    July 20, 2020

    I figured it out.

    The command "00 06 02 0A 04" doesn't work. I sniffed the communication between the reader and my ST95HF based device with a Proxmark3. It did send non-complete byte, but it wasn't 0x0A. After several attempts, I found that the command "00 06 02 A0 14" works fine.

    Although I noticed the description in the datasheet, I did not understand how it works. Thanks to your inspiration, now it works~

    THANK YOU !!!:thumbs_up:

    A
    Alan L.Author
    Visitor II
    July 20, 2020

    "00 06 02 A0 14" works.

    B
    Brian TIDAL
    Technical Moderator
    July 20, 2020

    I've done 50%, you've done the remaining part. Good job

    Rgds

    BT

    Terms & ConditionsAccessibility statement