TAG Emulation: Communication with NFC TagInfo

[MarcSt]

We want to use e.g. NTAG215 for our application. To facilitate debugging, I want to emulate such TAG on my iPhone.

• We got the HCE entitlement from Apple, thus may use the emulation API (CardSession).

• I implemented the flow of Appendix E "Example of Mapping Version 2.0 Command Flow" in the NFC Forum specification.

• I can successfully emulate a TAG with e.g. a URL (https://apple.com) from my iPhone to another iPhone (with the built-in background NFC reader), which will then open that website, as if it scanned a real NTAG215.

But when I try an Android as reader, neither the built-in background NFC reader nor NXP TagInfo can read my emulated TAG.

So I tried running TagInfo on my reader iPhone, and that also doesn't succeed reading my emulated TAG.

Here is the log from my emulation when it successfully transfers the URL to another iPhone (background NFC reader):

readerDetected
incoming commandApdu: 00a4040007d276000085010100
APDU_SELECT triggered. Our Response: A_OKAY
sending back data: 9000

incoming commandApdu: 00a4000c02e103
CAPABILITY_CONTAINER_OK triggered. Our Response: A_OKAY
sending back data: 9000

incoming commandApdu: 00b000000f
READ_CAPABILITY_CONTAINER triggered. Our Response: READ_CAPABILITY_CONTAINER_RESPONSE
sending back data: 001120ffffffff0406e104fffe00ff9000

incoming commandApdu: 00a4000c02e104
NDEF_SELECT_OK triggered. Our Response: A_OKAY
sending back data: 9000

incoming commandApdu: 00b0000002
NDEF_READ_BINARY_NLEN triggered. Our Response: length + A_OKAY
sending back data: 00169000

incoming commandApdu: 00b0000216
NDEF_READ_BINARY triggered. Our Response: data + A_OKAY
sending back data: d10112550068747470733a2f2f6170706c652e636f6d9000

readerDeselected. cardSession.stopEmulation

And here is the log when the reader iPhone is running TagInfo:

incoming commandApdu: 00a4040007d276000085010100
APDU_SELECT triggered. Our Response: A_OKAY
sending back data: 9000

incoming commandApdu: 9060000000
GET_VERSION triggered. Our Response: GET_VERSION_RESPONSE
sending back data: 000401010101010e039000

incoming commandApdu: 90af000000
MORE_INFO triggered. Our Response: APPLICATION_ERROR
sending back data: 6a88

incoming commandApdu: 90af000000
MORE_INFO triggered. Our Response: APPLICATION_ERROR
sending back data: 6a88

readerDeselected

So, instead of querying CAPABILITY_CONTAINER_OK, or READ_CAPABILITY_CONTAINER, TagInfo starts with asking GET_VERSION (which is not in the "Mapping Version 2.0 Command Flow") followed by MORE_INFO, to what I have no answer.

TagInfo didn't like my responses, and stopped reading.

1) What should I reply to GET_VERSION?

My current response is:

GET_VERSION_RESPONSE: {
0x00, // fixed header
0x04, // vendor ID (04 = NXP Semiconductors)
0x01, // product type
0x01, 0x01, // product subtype
0x01, // major product version
0x01, // minor product version
0x0E, // storage size
0x03, // protocol type: ISO/IEC 14443-3 compliant
0x90, 0x00, // A_OKAY
} //

2) What should I reply to MORE_INFO?

I tried

A_ERROR: {
0x6A, // SW1 Status byte 1 - Command processing status
0x82, // SW2 Status byte 2 - Command processing qualifier
} // 6A82 = File not found

and

APPLICATION_ERROR: {
0x6A, // SW1 Status byte 1 - Command processing status
0x88, // SW2 Status byte 2 - Command processing qualifier
} // 6A88 = no application ID

Thanks for answers,

Marc