ACR122 - Card Emulation

Question

How can I get the NFC contactless reader ACR122U to behave as a tag (card emulation mode)? The prospectus claims that the device can do card emulation, but the SDK does not seem

Answer 1

For "Card Emulation" or in other words, "Configure as target and wait for initiators", please refer to here: http://code.google.com/p/nfcip-java/source/browse/trunk/nfcip-java/doc/ACR122_PN53x.txt

** Command to PN532 **
0xd4 0x8c TgInitAsTarget instruction code
0x00 Acceptable modes
(0x00 = allow all, 0x01 = only allow to be
initialized as passive, 0x02 = allow DEP only)

_6 bytes (_MIFARE_)_:
0x08 0x00 SENS_RES
0x12 0x34 0x56 NFCID1
0x40 SEL_RES

_18 bytes (_Felica_)_:
0x01 0xfe 0xa2 0xa3 0xa4 0xa5 0xa6 0xa7
NFCID2
0xc0 0xc1 0xc2 0xc3 0xc4 0xc5 0xc6 0xc7
?
0xff 0xff System parameters?
0xaa 0x99 0x88 0x77 0x66 0x55 0x44 0x33 0x22 0x11
NFCID3
0x00 ?
0x00 ?

This is the response when an initiator activated this target:

** Response from PN532 **
0xd5 0x8d TgInitAsTarget response code
0x04 Mode
(0x04 = DEP, 106kbps)

Let me know if it works!

Answer 2

For getting the ACR122 (or rather the PN532 NFC controller chip inside it) into card emulation mode, you would do about the following:

1. ReadRegister:

   > FF000000 08 D406 6305 630D 6338
   < D507 xx yy zz 9000
   

2. Update register values:

   xx = xx | 0x004;  // CIU_TxAuto |= InitialRFOn
   yy = yy & 0x0EF;  // CIU_ManualRCV &= ~ParityDisable
   zz = zz & 0x0F7;  // CIU_Status2 &= ~MFCrypto1On
   

3. WriteRegister:

   > FF000000 11 D408 6302 80 6303 80 6305 xx 630D yy 6338 zz
   < D509 9000
   

4. SetParameters:

   > FF000000 03 D412 30
   < D513 9000
   

5. TgInitAsTarget

   > FF000000 27 D48C 05 0400 123456 20 000000000000000000000000000000000000 00000000000000000000 00 00
   < D58D xx ... 9000
   

   Where xx should be equal to 0x08.

6. Communicate using a sequence of TgGetData and TgSetData commands:

   > FF000000 02 D486
   < D587 xx <C-APDU> 9000
   

   Where xx is the status code (should be 0x00 for success) and C-APDU is the command sent from the reader.

   > FF000000 yy D48E <R-APDU>
   < D587 xx 9000
   

   Where yy is 2 + the length of the R-APDU (response) and xx is the status code (should be 0x00 for success).

Answer 3

You can use LibNFC. It has example code for this.

I still never got this working properly in Windows unfortunately. You will probably have to compile libnfc for specific drivers.

Also, the ACR122u seems to be pretty poorly supported by many libraries. Apparently it's not really designed for this use. There are particular issues for card emulation too (such as the timeout). We really all need to stop by the ACR122u. I just bought what was popular and easy to get hold of but regret it now.

To future browsers/searchers coming across this: please check the compatibility section on the libnfc site and buy something that they recommend!

Answer 4

Also you can try to send the following ADPU in HEX to put the reader in "Card emulation" mode:

FF 00 00 00 27 D4 8C 00 08 00 12 34 56 40 01 FE A2 A3 A4 A5 A6 A7 C0 C1 C2 C3 C4 C5 C6 C7 FF FF AA 99 88 77 66 55 44 33 22 11 00 00