cancel
Showing results for 
Search instead for 
Did you mean: 

ST25R3911B: How to read tag's memory?

Hello there,

I am using this shield:

https://www.st.com/en/ecosystems/x-nucleo-nfc05a1.html

Connected to the Nucleo64 L476RG board.

I wanted to utilize this demo:

https://www.st.com/content/st_com/en/products/embedded-software/st25-nfc-rfid-software/x-cube-nfc5.html

The problem was that there is the source code generated by CubeMX provided, without the actual CubeMX project available. Because of that, instead of generating code from CubeMx, I had to generate CubeMx project from code by hand. I have placed the whole project here in case anyone needs that:

https://github.com/bremenpl/NFC5

The project works and the demo reads some data from a tag placed on the PCB antenna.

I need to read the tags memory (that 256 bytes of data) but I dont know how to do that. In the demo, there are a lot of hardcoded variables and the whole architecture is merely readable. After a while I found out that in this function the data is exchanged:

demo.c:

/*!
 *****************************************************************************
 * \brief Exchange APDUs
 *
 * Example how to exchange a set of predefined APDUs with PICC. The NDEF
 * application will be selected and then CC will be selected and read.
 * 
 *****************************************************************************
 */
void demoSendAPDUs( void )
{
  uint16_t   rxLen;
  ReturnCode err;
  
  /* Exchange APDU: NDEF Tag Application Select command */
  err = demoIsoDepBlockingTxRx(&gDevProto.isoDepDev, ndefSelectApp, sizeof(ndefSelectApp), gRxBuf.rxBuf, sizeof(gRxBuf.rxBuf), &rxLen);
  
  if( (err == ERR_NONE) && gRxBuf.rxBuf[0] == 0x90 && gRxBuf.rxBuf[1] == 0x00)
  {
    platformLog(" Select NDEF App successfully \r\n");
    
    /* Exchange APDU: Select Capability Container File */
    err = demoIsoDepBlockingTxRx(&gDevProto.isoDepDev, ccSelectFile, sizeof(ccSelectFile), gRxBuf.rxBuf, sizeof(gRxBuf.rxBuf), &rxLen);
    
    /* Exchange APDU: Read Capability Container File  */
    err = demoIsoDepBlockingTxRx(&gDevProto.isoDepDev, readBynary, sizeof(readBynary), gRxBuf.rxBuf, sizeof(gRxBuf.rxBuf), &rxLen);
  }
}

I need to figure out what command to send in order to read the memory. Its not easy, since the Author decided to hardcode all the used commands:

/* P2P communication data */
static uint8_t NFCID3[] = {0x01, 0xFE, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A};
static uint8_t GB[] = {0x46, 0x66, 0x6d, 0x01, 0x01, 0x11, 0x02, 0x02, 0x07, 0x80, 0x03, 0x02, 0x00, 0x03, 0x04, 0x01, 0x32, 0x07, 0x01, 0x03};
    
/* APDUs communication data */    
static uint8_t ndefSelectApp[] = { 0x00, 0xA4, 0x04, 0x00, 0x07, 0xD2, 0x76, 0x00, 0x00, 0x85, 0x01, 0x01, 0x00 };
static uint8_t ccSelectFile[] = { 0x00, 0xA4, 0x00, 0x0C, 0x02, 0xE1, 0x03};
static uint8_t readBynary[] = { 0x00, 0xB0, 0x00, 0x00, 0x0F };
/*static uint8_t ppseSelectApp[] = { 0x00, 0xA4, 0x04, 0x00, 0x0E, 0x32, 0x50, 0x41, 0x59, 0x2E, 0x53, 0x59, 0x53, 0x2E, 0x44, 0x44, 0x46, 0x30, 0x31, 0x00 };*/
 
/* P2P communication data */    
static uint8_t ndefPing[] = {0x00, 0x00};
static uint8_t ndefInit[] = {0x05, 0x20, 0x06, 0x0F, 0x75, 0x72, 0x6E, 0x3A, 0x6E, 0x66, 0x63, 0x3A, 0x73, 0x6E, 0x3A, 0x73, 0x6E, 0x65, 0x70, 0x02, 0x02, 0x07, 0x80, 0x05, 0x01, 0x02};
static uint8_t ndefUriSTcom[] = {0x13, 0x20, 0x00, 0x10, 0x02, 0x00, 0x00, 0x00, 0x19, 0xc1, 0x01, 0x00, 0x00, 0x00, 0x12, 0x55, 0x00, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x77, 0x77, 0x77, 0x2e, 0x73, 0x74, 0x2e, 0x63, 0x6f, 0x6d};

Basing on this it is not possible to figure out what is the frame format or anything. I could not find it in the datasheet either.

I would really appreciate all help regarding this issue. Any hints or links for finding the required information (or providing it) would be really helpful!

1 ACCEPTED SOLUTION

Accepted Solutions
Ulysses HERNIOSUS
ST Employee

Hi Lukasz,

for the reading the memory of specific tags you will not find information inside the datasheet of the reader but inside the datasheet of the tag. Assuming you have a ST25TA02K (cloud tag):

https://www.st.com/content/st_com/en/products/nfc/st25-nfc-rfid-tags-readers/st25-nfc-rfid-tags/st25ta-series-nfc-tags/st25ta02kb.html

The RF command sets inside are compatible also to NFC Forum T4T definitions.

The commands are detailed in section 6.7.

Regards, Ulysses

View solution in original post

2 REPLIES 2
Ulysses HERNIOSUS
ST Employee

Hi Lukasz,

for the reading the memory of specific tags you will not find information inside the datasheet of the reader but inside the datasheet of the tag. Assuming you have a ST25TA02K (cloud tag):

https://www.st.com/content/st_com/en/products/nfc/st25-nfc-rfid-tags-readers/st25-nfc-rfid-tags/st25ta-series-nfc-tags/st25ta02kb.html

The RF command sets inside are compatible also to NFC Forum T4T definitions.

The commands are detailed in section 6.7.

Regards, Ulysses

Hi,

Thank you for answer. I will check it out.