How do I read a record's payload from an NXP MIFARE Ultralight tag?

Question

I've got a couple of NXP MIFARE Ultralight tags (type 2) that contain some data in the first record. I'm using an ACS 1252U to read the tags, and I've tried manually iterating over some of the data to get a sense of what's on the tag, but I can't seem to figure out how to determine where the record begins and where it ends.

Here's some detailed information on the NFC tag and the record I'm trying to read:

And here's some data from one of my tags starting at page 04:

03 ff 01 5a
c4 0f 00 00
01 45 62 63
61 72 64 2e
6e 65 74 3a
62 63 61 72
64 39 39 37
30 31 1e 34

Now if I convert all of that to ASCII, I get the following:

ÿZÄEbcard.net:bcard997014

All I know is that the actual data I'm after (or the payload) begins at 99701, but how in the world am I supposed to know that? Surely there's something in the data that can tell me where the record's payload starts and where it stops?

Answer 1

数据完全符合Type 2 Tag规范。类型2标签的数据页从页面/块4开始。数据被嵌入到TLV结构中。

在您的情况下，第4页的第一个字节是NDEF消息TLV（0x03）的标记。下一个字节表示字段长度以3字节格式编码。因此，长度为0x015A（= 346字节）。因此，您必须阅读接下来的87页（由于数据从页面边界开始，所以= ceil（346/4））才能检索完整的NDEF消息。

NDEF消息本身包含1条NDEF记录（标头字节0xC4表示该记录是消息的第一（MB = 1）和最后（ME = 1）条记录）。该记录是NFC论坛外部类型（标头字节中的TNF = 4）。类型名称的长度为0x0F（= 15字节）。有效负载的长度为0x0145（= 325字节）。因此，类型名称为“ bcard.net:bcard”，有效负载为“ 39 39 37 30 31 1E 34 ...”（ITN似乎尚未发布有关其bcard类型结构的规范）。 / p>

有关如何解码这些TLV结构和NDEF消息，请参见How to interpret NDEF content on Mifare Classic 1K。