Skip to content

Conversation

dogtopus
Copy link
Contributor

@dogtopus dogtopus commented Apr 25, 2025

What's new

This is a continuation of #4202.

NFC TagInfo, probably all NDEF Type 3 readers, and possibly other readers rely on Polling commands with Request Code of 1 (default System Code request) and non-FFFF System Code to detect card type. The NFC controller doesn't seem to handle the latter case in hardware and simply bubbles those commands up to the firmware layer. The firmware in its current form then gets confused and interrupts the transaction, resulting in failed reading attempts.

This PR adds a handler for when a Polling command with non-FFFF System Code is seen on the firmware side, so that readers behaving like NFC TagInfo could read the emulated card without failing.

Verification

  • Use the .nfc file provided here: F.zip
  • Scan with NFC TagInfo. It should read the entire contents of the emulated card, including having the correct decoding on the NDEF tab.
  • Scan with no reader app. It should open https://example.com
  • Use Proxmark3 to send polling commands to the emulated card. It should return something similar to below:
[usb] pm3 --> hf felica raw -c 060088b40000
[+] Data: 06 00 88 B4 00 00 F7 25 
[+] (22) B2 4D 12 01 01 2E 46 65 6C 69 43 61 00 F1 00 00 00 01 43 00 D8 9F 
[usb] pm3 --> hf felica raw -c 060088b40100
[+] Data: 06 00 88 B4 01 00 C4 14 
[+] (24) B2 4D 14 01 01 2E 46 65 6C 69 43 61 00 F1 00 00 00 01 43 00 88 B4 26 1C 
[usb] pm3 --> hf felica raw -c 060088b40200
[+] Data: 06 00 88 B4 02 00 91 47 
[+] (24) B2 4D 14 01 01 2E 46 65 6C 69 43 61 00 F1 00 00 00 01 43 00 00 83 F2 99 
[usb] pm3 --> hf felica raw -c 060012fc0000
[+] Data: 06 00 12 FC 00 00 ED 1D 
[+] (22) B2 4D 12 01 01 2E 46 65 6C 69 43 61 00 F1 00 00 00 01 43 00 D8 9F 
[usb] pm3 --> hf felica raw -c 060012fc0100
[+] Data: 06 00 12 FC 01 00 DE 2C 
[+] (24) B2 4D 14 01 01 2E 46 65 6C 69 43 61 00 F1 00 00 00 01 43 00 12 FC 18 F0 
[usb] pm3 --> hf felica raw -c 060012fc0200
[+] Data: 06 00 12 FC 02 00 8B 7F 
[+] (24) B2 4D 14 01 01 2E 46 65 6C 69 43 61 00 F1 00 00 00 01 43 00 00 83 F2 99

Checklist (For Reviewer)

  • PR has description of feature/bug or link to Confluence/Jira task
  • Description contains actions to verify feature/bugfix
  • I've built this code, uploaded it to the device and verified feature/bugfix

NFC TagInfo and possibly other readers rely on Polling commands with Request Code of 1 (default System Code request) or non-FFFF System Code to detect card type. Since the NFC controller doesn't seem to handle them in hardware and simply bubbles them up, and then the Flipper firmware will just ignore them and refuse to respond afterwards, this causes the reading operation to fail.

This commit adds a simple handler for such Polling commands so that readers behaving like NFC TagInfo could read the emulated card without failing.
The NFC controller should handle Polling commands with the System Code set to FFFF, so it's not necessary for the firmware to handle it.
We already have enough information to determine whether or not the card supports NDEF since SYS_OP register value is included in all current Lite-S card dumps.
This allows the reader to specifically select the service by naming the Service Code.
@hedger hedger added the NFC NFC-related label Apr 26, 2025
Introduce nfc_felica_listener_timer_anticol_start() and nfc_felica_listener_timer_anticol_stop(). These are for now just wrappers around the block_tx timer that can be used to delay the response until the desired Time Slot. Thanks to the loose timing constraints of FeliCa collision resolution protocol, no compensation seems to be necessary. Also enabled the block_tx timer for FeliCa listener, but with both compensation and fdt set to 0 to keep the original behavior of not using the timer during normal data exchange.

This API is now being used for handling Polling commands that are not handled by the NFC controller on the hardware side.
@dogtopus dogtopus requested a review from nminaylov as a code owner April 29, 2025 14:02
@dogtopus dogtopus changed the title FeliCa Emulation: Handle non-hardware Polling commands FeliCa Emulation: Handle certain Polling commands in firmware Apr 29, 2025
@dogtopus
Copy link
Contributor Author

dogtopus commented May 5, 2025

I fixed the HACK part and this should be ready for review again.

Copy link
Contributor

@RebornedBrain RebornedBrain left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for your work on this PR, NDEF and system codes for Felica are great! But there are some parts of code which would be better to adjust a little bit. I described my idea in review comments. And also here is a complete patch felica_polling.patch, which implements it.
Would you please apply it, validate that it works and update your PR?
Thanks in advance! 🐱

@dogtopus
Copy link
Contributor Author

Any progress on the review? @RebornedBrain

@RebornedBrain
Copy link
Contributor

Hi @dogtopus, sorry didn't see message. Everything looks fine to me! @hedger could you please approve and merge

@dogtopus
Copy link
Contributor Author

It's been 3 months and this PR still isn't merged. Is there a problem with the code?

@hedger hedger added the New Feature Contains an IMPLEMENTATION of a new feature label Sep 24, 2025
@hedger
Copy link
Member

hedger commented Sep 24, 2025

@dogtopus sorry for the delay

@hedger hedger merged commit dfd7537 into flipperdevices:dev Sep 24, 2025
10 of 11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
New Feature Contains an IMPLEMENTATION of a new feature NFC NFC-related
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants