Can't remove NTAG213 protection

[r_n123]

Hi,
I'm using NFC tags based on NXP NTAG213.
Using NXP TAGWRITER I set a new password and than I try to remove protection, but the error "TAG can't be unprotected" occures
As I try to remove just the password, the AUTH0 register remains set to 0x27, so I can't change the configuration registers nor write 0xFF to AUTH0 - I/O failure occures.
Is there any way I can remove the password and protection using TAGWRITER?

I tryed it with multiple tags and the ffect is the same. At the beginning the tags are unprotected. The PROTECT bit is set to 0, CFGLOC is set to 0 too.

[Shimo420]

I have an NTAG215 and I ran into the same problem. By luck I can write again. 

- In TagWriter I clicked on the three dots on the upper right, then preferences, and then password. This was set to default FFFFFFFF, I entered the password I set it to.

- Then I clicked protect tags in the main screen, then password protection, and I checked current password. Now the password I set it to was being displayed. 

- In the drop down menu under current password I selected remove password, hit done. Tap, confirm, tap and IT WORKED!!!!

- To re-enable the password select keep password under the same drop down menu. 

Hope this works for you.

[EchoBeach]

Anyone solve this? I'm also trying to remove password and modify tag contents. When I Remove Password, it shows the following Result:

Password protection has been removed

But then when I try to write new dataset I get the following Result:

Read only, can not store

I was able to Erase & format as NDEF, then tried writing to the tag again, but same result as above.

Is it not possible to password protect, remove password, modify content, and password protect again?

I'm using NTAG213's.

[1simone0]

Hello there, someone solved this problem???

[Jonathan_Iglesias]

My apologies for the language in the images, it is Spanish,  this is weird  is it possible that you send me an image of the memory content while authenticated ? I want to see the Static lock bytes  value.

BR

Jonathan

[r_n123]

Here are the screens you asked for :smileywink: The static lock bits are all zeros (the default value)

[r_n123]

After further research there are two things I have to add:

1) As I get a fresh-new tag, I can see the AUTH0 is set to 0xFF. After I use the set password option, it is changed automatically to 0x04 - Capability Container (so that the whole user memory is protected). As I use the mentioned remove password option, the AUTH0 is set to 0x27 - the last word in user memory of my NTAG213 ( in datasheet it is said: "If AUTH0 is set to a page address which is higher than the last page from the user configuration, the password protection is effectively disabled").

2) It is said "Access to the configuration pages and any part of the user memory can be restricted by setting AUTH0 to a page address within the available memory space. This page address is the first one protected."

As I can see, the TAGWRITER app is written in line with the NTAG213 datasheet, but either there is an error in the datasheet, or a bug in the NTAG213.

Was't it better to have the TAGWRITER writing 0xFF to the AUTH0 register while removing password protection? Like a "restore factory configuration"?

My question remains: how to regain the ability to write to the configuration registers? Is there any other, manual opportunity to write to the AUTH0 register using the TAGWRITER and the password authentication?

[Jonathan_Iglesias]

Hi Robert Nawrath,

please confirm this is the path you are following 

to remove you should do the same but  select the following :

BR 

Jonathan

[r_n123]

Hi Jonathan,

Thank you for the answer. I don't know the language you use in your screen, but as I recognize the app GUI, I followed the same steps as you did. 

As I wrote just at the beggining, I tried to remove the password, but the AUTH0 (MSB in 0x29 register) remains 0x27 and cannot be changed by me, because an I/O failure occures. This shouldn't happen if I only set and removed the password, am I right?

To write the value 0x040000FF to the register 0x29 I use the andvanced features in NFC tools app. This works fine unless I set and remove the password.

So to precise my question: how to regain the ability to write to AUTH0 register after I set and remove the password?