Skip to main content
Visitor II
September 27, 2018
Solved

ST25R3911B: How to read tag's memory?

  • September 27, 2018
  • 2 replies
  • 1054 views

Hello there,

I am using this shield:

https://www.st.com/en/ecosystems/x-nucleo-nfc05a1.html

Connected to the Nucleo64 L476RG board.

I wanted to utilize this demo:

https://www.st.com/content/st_com/en/products/embedded-software/st25-nfc-rfid-software/x-cube-nfc5.html

The problem was that there is the source code generated by CubeMX provided, without the actual CubeMX project available. Because of that, instead of generating code from CubeMx, I had to generate CubeMx project from code by hand. I have placed the whole project here in case anyone needs that:

https://github.com/bremenpl/NFC5

The project works and the demo reads some data from a tag placed on the PCB antenna.

I need to read the tags memory (that 256 bytes of data) but I dont know how to do that. In the demo, there are a lot of hardcoded variables and the whole architecture is merely readable. After a while I found out that in this function the data is exchanged:

demo.c:

/*!
 *****************************************************************************
 * \brief Exchange APDUs
 *
 * Example how to exchange a set of predefined APDUs with PICC. The NDEF
 * application will be selected and then CC will be selected and read.
 * 
 *****************************************************************************
 */
void demoSendAPDUs( void )
{
 uint16_t rxLen;
 ReturnCode err;
 
 /* Exchange APDU: NDEF Tag Application Select command */
 err = demoIsoDepBlockingTxRx(&gDevProto.isoDepDev, ndefSelectApp, sizeof(ndefSelectApp), gRxBuf.rxBuf, sizeof(gRxBuf.rxBuf), &rxLen);
 
 if( (err == ERR_NONE) && gRxBuf.rxBuf[0] == 0x90 && gRxBuf.rxBuf[1] == 0x00)
 {
 platformLog(" Select NDEF App successfully \r\n");
 
 /* Exchange APDU: Select Capability Container File */
 err = demoIsoDepBlockingTxRx(&gDevProto.isoDepDev, ccSelectFile, sizeof(ccSelectFile), gRxBuf.rxBuf, sizeof(gRxBuf.rxBuf), &rxLen);
 
 /* Exchange APDU: Read Capability Container File */
 err = demoIsoDepBlockingTxRx(&gDevProto.isoDepDev, readBynary, sizeof(readBynary), gRxBuf.rxBuf, sizeof(gRxBuf.rxBuf), &rxLen);
 }
}

I need to figure out what command to send in order to read the memory. Its not easy, since the Author decided to hardcode all the used commands:

/* P2P communication data */
static uint8_t NFCID3[] = {0x01, 0xFE, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A};
static uint8_t GB[] = {0x46, 0x66, 0x6d, 0x01, 0x01, 0x11, 0x02, 0x02, 0x07, 0x80, 0x03, 0x02, 0x00, 0x03, 0x04, 0x01, 0x32, 0x07, 0x01, 0x03};
 
/* APDUs communication data */ 
static uint8_t ndefSelectApp[] = { 0x00, 0xA4, 0x04, 0x00, 0x07, 0xD2, 0x76, 0x00, 0x00, 0x85, 0x01, 0x01, 0x00 };
static uint8_t ccSelectFile[] = { 0x00, 0xA4, 0x00, 0x0C, 0x02, 0xE1, 0x03};
static uint8_t readBynary[] = { 0x00, 0xB0, 0x00, 0x00, 0x0F };
/*static uint8_t ppseSelectApp[] = { 0x00, 0xA4, 0x04, 0x00, 0x0E, 0x32, 0x50, 0x41, 0x59, 0x2E, 0x53, 0x59, 0x53, 0x2E, 0x44, 0x44, 0x46, 0x30, 0x31, 0x00 };*/
 
/* P2P communication data */ 
static uint8_t ndefPing[] = {0x00, 0x00};
static uint8_t ndefInit[] = {0x05, 0x20, 0x06, 0x0F, 0x75, 0x72, 0x6E, 0x3A, 0x6E, 0x66, 0x63, 0x3A, 0x73, 0x6E, 0x3A, 0x73, 0x6E, 0x65, 0x70, 0x02, 0x02, 0x07, 0x80, 0x05, 0x01, 0x02};
static uint8_t ndefUriSTcom[] = {0x13, 0x20, 0x00, 0x10, 0x02, 0x00, 0x00, 0x00, 0x19, 0xc1, 0x01, 0x00, 0x00, 0x00, 0x12, 0x55, 0x00, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x77, 0x77, 0x77, 0x2e, 0x73, 0x74, 0x2e, 0x63, 0x6f, 0x6d};

Basing on this it is not possible to figure out what is the frame format or anything. I could not find it in the datasheet either.

I would really appreciate all help regarding this issue. Any hints or links for finding the required information (or providing it) would be really helpful!

    This topic has been closed for replies.
    Best answer by Ulysses HERNIOSUS

    Hi Lukasz,

    for the reading the memory of specific tags you will not find information inside the datasheet of the reader but inside the datasheet of the tag. Assuming you have a ST25TA02K (cloud tag):

    https://www.st.com/content/st_com/en/products/nfc/st25-nfc-rfid-tags-readers/st25-nfc-rfid-tags/st25ta-series-nfc-tags/st25ta02kb.html

    The RF command sets inside are compatible also to NFC Forum T4T definitions.

    The commands are detailed in section 6.7.

    Regards, Ulysses

    2 replies

    Technical Moderator
    September 27, 2018

    Hi Lukasz,

    for the reading the memory of specific tags you will not find information inside the datasheet of the reader but inside the datasheet of the tag. Assuming you have a ST25TA02K (cloud tag):

    https://www.st.com/content/st_com/en/products/nfc/st25-nfc-rfid-tags-readers/st25-nfc-rfid-tags/st25ta-series-nfc-tags/st25ta02kb.html

    The RF command sets inside are compatible also to NFC Forum T4T definitions.

    The commands are detailed in section 6.7.

    Regards, Ulysses

    Visitor II
    September 28, 2018

    Hi,

    Thank you for answer. I will check it out.