Introduction

Near Field Communication (NFC) technology has become increasingly popular due to its simplicity and versatility. NFC tags, small chips that use radio waves to communicate with nearby devices, can be used for a variety of applications, from contactless payments to smart home automation. One of the more advanced uses of NFC technology is writing unique keys to NFC tags, a process that requires a decent understanding of the NFC data structure. This article provides a detailed, step-by-step guide to writing NFC tags using unique keys.

Understanding the NFC Data Structure

The first step in writing to an NFC tag is understanding the structure of the data stored on the tag. An NFC tag is divided into sectors, and each sector is further divided into blocks. The number of sectors and blocks varies depending on the type of NFC tag. For instance, the MIFARE Classic 1K tag, a common type of NFC tag, has 16 sectors, each containing 4 blocks. Each block can store 16 bytes of data.

The data stored in these blocks can include anything from URLs to text strings to unique keys. In the context of this guide, the unique key is a specific piece of data retrieved from an NFC reader, such as the Flipper Zero. This key is stored in a specific block on the NFC tag.

Locating the Correct Block

The unique key retrieved from the reader is stored in a specific block. In the case of the Flipper Zero, it's stored in page 18 of the NFC file. This corresponds to a specific sector and block on the NFC tag. To find the correct block, you need to understand how the pages correlate to sectors and blocks.

For example, if each sector contains 4 blocks, then page 18 would be in sector 4, block 2. This is calculated by dividing the page number by the number of blocks per sector (18 divided by 4 equals 4.5, rounded down to the nearest whole number for the sector), and finding the remainder when the page number is divided by the number of blocks per sector (18 modulo 4 equals 2 for the block).

Editing the Block

Once you've located the correct block, the next step is to edit the block with the new unique key. This requires a text editor capable of handling binary data, such as HxD for Windows or Hex Fiend for macOS. These editors display the data in the file as a series of hexadecimal numbers.

Each block of data will be 16 bytes (or 32 hexadecimal digits) long. To replace the existing data with the new unique key, find the correct block based on the sector and block number calculated earlier. The unique key should be the same length as the existing data (16 bytes), and should be entered as a series of hexadecimal digits.

For example, if the unique key is '1234567890ABCDEF', you would replace the existing data in the block with this key. Be careful to maintain the same length of data, as changing the length could corrupt the tag.

Writing the NFC File to the Tag

The final step is to write the modified NFC file to the NFC tag. This requires an NFC writing tool, which could be a dedicated device or an app on a smartphone with NFC capabilities. The writing tool will overwrite the existing data on the tag with the data from the NFC file.

For example, if you're using an Android smartphone, you could use an app like NXP TagWriter. After loading the modified NFC file into the app, place the NFC tag near the smartphone. The app will then write the data from the file to the tag.

Conclusion

Remember, it's important to only write to NFC tags that you own and have permission to modify, and to always be careful when manipulating the data on an NFC tag to avoid corrupting the tag. This guide was to give you a better understanding of how NFC technology works, next week we dive deeper and execute emulating an NFC tag using the unique key recovered from the Flipper Zero. Follow me on twitter for more frequent updates, as well as hardware and software engineering tips! TWITTER: @RobotProxyWar