Write NDEF URI on Mifare Classic

Various news story discuss that the new iPhone XS/XR can trigger automation  based on NFC tags. Most of the stories were around "Launch Center Pro" having this as a feature, here is the one that "The Verge" had. I thought I can finally do something useful with the "Launch Center Pro" app that I had bought two years ago, but not so fast, my friend. The iPad version that I had purchased had changed it's name to "Launch" somewhere on the way and is now no longer available in the app store. Contrast seems to offer again a "Launch Center Pro" for iPhone and iPad on the app store, with slightly heavier monetization. The "NFC Triggers" are 4.99 USD - that's what I had paid for the complete app in its ealier revision.

While researching and reading a little more, I started to understand the mechanism better, with this reddit posting being the eye opener. My TL;DR:

  • Starting from iOS 12, iPhone XS/XR will automatically read NDEF formated NFC tags
  • If the tag contains a URI record, iOS will ask whether it should open the URL
  • Many iOS applications can be opened and controlled with URL schemes

Here is the PoC for:

  • creating an URI record in an NDEF formated message
  • writing the NDEF message to a Mifare Classic card

Creating an URI record in an NDEF formated message

The message below is created using the nfcpy module which was installed with pip. The URL is pointing to another automation tool, Apple's own Shortcuts (free download from the iOS app store), starting the automation "testflow".

ds@ubuntu:~$ python
Python 2.7.15rc1 (default, Nov 12 2018, 14:31:15) 
[GCC 7.3.0] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import nfc.ndef
No handlers could be found for logger "nfc.llcp.sec"
>>> record = nfc.ndef.UriRecord("shortcuts://run-shortcut?name=testflow")
>>> message = nfc.ndef.Message(record)
>>> sfile=open('shortcut-ndef','w')
>>> sfile.write(str(message))
>>> sfile.close()
>>> quit()

Writing the NDEF Message to a Mifare Classic card

The used equipment is an Itead Studio PN532 module that is connected to a linux machine with a serial to USB converter (Itead Studio - FOCA v2.2). The software to write is part of the libfreefare project, the Ubuntu distribution provided packages  got installed with apt-get.

libnfc (which gets installed with libfreefare) will need a hint where the reader/writer is connected and this can be configured in /etc/nfc/libnfc.conf

device.name = "daniels532"
device.connstring = "pn532_uart:/dev/ttyUSB0"

Your mileage may vary, depending on reader/writer device type and other used ports, this needs customization for other environments.

Once connectivity and reachability of the hardware is secured, the mifare-classic-write-ndef command can be used to write to the Mifare Classic card

ds@ubuntu:~$ sudo mifare-classic-write-ndef -i shortcut-ndef 
NDEF file is 50 bytes long.
Found Mifare Classic 1k with UID d78d9fe0. Write NDEF [yN] y
Hardware Setup: Reader/Writer, Serial/USB adapter, Mifare Classic card