NFC Emulator doesnt seem to work

NFC
#1

Hello everyone,

I’ve seen few similar posts but not quite like my case.
I received my two flipper zeros last week, and after some tests, it seems that the nfc emulator doesnt seem to work on one of them.

The fact that I have two flipper helped me a lot in the troubleshooting process.

Tests wered done with a NFC-A, the card is not a banking card nor an ultra light tag.
These test have been ran on firmware version 0.43.1 then later on 0.62.1 ( for both flippers )

Flipper 1 reading card 1 : OK
Flipper 1 reading Card 2 : OK
Flipper 2 reading Card 1 : OK
FLipper 2 reading Card 2 : OK
Flipper 2 emulating card 1 on door NFC reader : NOK
FLipper 2 emulating Card 2 on door NFC reader: NOK
FLipper 1 emulating Card 1 on door NFC reader: OK door opening
FLipper 1 emulating Card 2 on door NFC reader: OK door opening
Flipper 1 reading emulating card 2 from Flipper 2 : NOK
Flipper 1 reading emulating card 1 from Flipper 2 : NOK
Flipper 2 reading emulating card 2 from Flipper 1 : OK, info of the card 1 shows on Flipper 2
Flipper 2 reading emulating card 1 from Flipper 1 : OK, info of the card 2 shows on Flipper 1

At the light of these tests it seem that the flipper 2 cannot emulate the NFC.
I tried to update the frimware without any chance.

I’ll try to upload a video of the inter-flipper tests to show that one can emulate and not the other.

What Can I do ? How can I check if it’s a hardware issue ?

Thank you for you advices !

Have a great day.

1 Like
#2

What type of card it is? If it’s a Mifare Classic then the emulation indeed does vary with each device at the moment

1 Like
#3

Interesting, where can I read more about this ?

I see that the cards are SAK:20 which is supposed to be MIFARE DESFire. ( ATQA:0x4403 and SAK:0x20)
Which surprised me since I saw smwhere that it couldnt be emulated.

Edit: I found a very good documentation that I shall read https://www.nxp.com/docs/en/application-note/AN10833.pdf

#4

That was the question

What type of card is displayed on the Flipper’s screen? Are you emulating just the UID?

#5

I think I’m emualting just the UID.
The flipper screen shows :

 NFC-A may be:
 EMV bank card
 ATQA:4403 SAK:20
 UID : 04 44 55 AD 55 55 55

But I don’t understand how one flipper could emulate the full card and not the other flipper ( with the same card ).

#6

Hm, that’s very weird

Can you try swapping SD cards?
And also, just to verify, both of them are running the same firmware, right?

#7

Same Problem here! I’ve received my Flipper Zero this week and could scan my card (also Mifare DESfire) without problems, but if I emulate the card, the reader is completely unimpressed and shows no reaction. If I try reading the emulated card with my phone, it says “NFC read error” (I’m trying with NFC tools app on a Redmi Note 9 Pro).
I’ve just installed the new fw version 0.63.2-rc via the Android app and it seems, that the NFC part currently is reworked. Still my phone only shows an error. Any ideas on the topic?

I’m using a 64gb Sandisk Ultra btw, because swapping the SD cards was mentioned :slight_smile:

#8

same here - I try to duplicate our access card for our home. when reading the flipper says “maybe mifare classic” - it reads 2/32 “total keys”, there is no HEX code on the card itself, flipper reads one…
so I am happy to get any help here
the emulation does not work on the reader on the door, no reaction

as I understood, there are several authorization levels with our cards, e.g. my wife has a “female” card - she can have access to other rooms in the house as myself…

is this security level “too much” for the flipper or are we missing some data? many thanks

#9

Mifare DESfire cards can’t be emulated, you’re just emulating the UID of the card, not its contents

#10

Mifare Classic cards have a boult-in cryptographic read protection, and to read the whole card you need to know all 32 keys for the 16 sectors (some can be only read with the A key, some only with the B key). We use a dictionary attack, but the keys from your card may not be in the dictionary, in which case we can’t read the card. You’ll need to run a more advanced attack using a device like a proxmark3, as the flipper doesn’t support them at the moment. This will be added in the future though.

#11

Hi,

@talas It’s not the same problem since I don’t even have this error message.
@Atkamen It’s not the same issue, since my flipper doesnt say mifare classic, nor I have any mifare classic tag.

@Astra So, Sorry for the late reply, both of them are running the same firmware version 0.43.1, it’s the firmware version i’ve received them with.
But I think I Found the issue I’m facing. That’s very weird.
If I read the NFC card then directly go to the menu “emulate uid” it doesn’t open the door.
But When I go to “run compatible app” it then tries to read a “banking card”, then I go back to the action menu and now go to emulate uid, it works.

To summarize :
Action 1 :
Menu > NFC > read Card > Card detected :

 NFC-A may be:
 EMV bank card
 ATQA:4403 SAK:20
 UID : 04 44 55 AD 55 55 55

More >Emulate UID :

Doesnt Work , door wont open

Action 2 :

More > Run compatible APP > “Reading Bank Card” > back > More >Emulate UID ::

Door opens

I then record the UID and save it, it will open the door everytime.

No SD card is plugged in, the card is a Mifare Desfire

You can check the following video for more precisions on the actions :

Ok so now I know why the second flipper couldnt open the door, it’s because the second “recording” was different so, It’s not a issue per se, but still I’m intringed of what’s happening.

Is the entry “run compatible app” starting an attack ? If so I don’t see why it doesnt take more time.
Did the flipper zero made a mistake on the identification of the card ?

Thanks again !

#12

The 0.43.1 version is WILDLY outdated at the moment, please update via https://update.flipperzero.one ASAP

The DESfire support hasn’t even been added then, so no wonder the behaviour is weird

#13

Yes I know, in fact I donwgraded specifically to this version to reproduce this bug as I do not have the same menus in the last version.
In fact it only propose me to save the UID when it detected the Mifare Desfire.