tagsnfcrfidmifarefingerprinting

How to programmatically detect the memory size/page number of an NFC chip


What is the easiest way to programmatically detect the memory size or page count of an NFC chip (MIFARE Ultralight or NTAGxxx) other than probing for specific page numbers and checking if they exist?

Is there a specific byte in the ATR returned or somewhere stored in the protected zone of the chip's memory that tells whether it's a specific NTAGxxx chip, or the page count or the byte count?


Solution

  • In general you can only determine this by extensive fingerprinting and by probing with read commands.

    1. Fingerprinting: This means that you would need to have a database of manufacturer-specific characteristics (e.g. collected from datasheets and -- unfortunately by far more often -- from empirical testing, as such information is not (publicly? or at all?) documented for most tags) that you can check your tag against.

    2. Probing:

      • Start at page 0
      • Read page
      • On success: increment read address by 4 pages and start over
      • On failure: decrement read address by 1 and try to read again until you find a readable address
      • On sector end: start over with next sector

      That way you can find the last readable page address, which is not necessarily the "real" end of the tag memory (e.g. there might be protected pages at the end).

    If your Ultralight and NTAG tags are EV1 tags (i.e. they implement the Ultralight EV1 command set), the expose a GET_VERSION command which you can use to retrieve storage size information. The version information in combination with a database of all existing tag fingerprints (you can get that information from the Ultraight/NTAG datasheets) will allow you to reliably1 determine the tag type and, consequently, the memory size.

    1) With the exception of some counterfeit chips sold as "NTAG" that imitate parameters of real NTAG chips but seem to have memory sizes, lack of command support, etc. that do not match the chip of which they imitate the parameters.

    When it comes to NFC tags that follow the NFC Forum Type 2 tag operation specifications, you could also rely on the tag memory size that is coded into the capability container. This memory size is not necessarily the physical memory size though.