nfc-emulate-uid(1)

✨ nfc-emulate-uid — the libnfc example that lets you be ANY tag you wanna be 💅

okay bestie, so this is nfc-emulate-uid(1), one of the examples that ships with libnfc, and it is lowkey iconic and highkey terrifying. Let's get into it. 🎀

🌸 NAME 🌸

nfc-emulate-uid — an NFC target emulation command line tool based on libnfc

🦋 SYNOPSIS 🦋

nfc-emulate-uid [OPTIONS] [UID]

✨ DESCRIPTION ✨

So nfc-emulate-uid is a tag emulation tool, and the whole point is that you get to pick any tag UID you want. Tag emulation is literally one of the main added features in NFC, periodt. But — and this is the tea — to stop people from abusing existing systems, the manufacturers of the NFC controller intentionally did NOT support emulating a fully customized UID. They only let you do "random" UIDs, which always start with 0x08. 🙈

And nfc-emulate-uid is here to demonstrate that you can still do it anyway by transmitting raw frames, and the UID you want can optionally be specified. Which makes this thing a serious threat for security systems that rely only on the uniqueness of the UID. not me exposing your whole threat model 😭

Unfortunately, this example can't directly start in fully customisable target mode. Just after launching it, you'll have to go through the hardcoded initial anti-collision with the 0x08-prefixed UID. To achieve that, you can e.g. send a RATS (Request for Answer To Select) command by using a second NFC device (placed in target's field) and launching nfc-list or nfc-anticol. After this first step, you now have a NFC device (configured as target) that really emulates a custom UID. You could view it using the second NFC device with nfc-list. slay. ✨

Timing control is very important for a successful anti-collision sequence, bestie. Listen up:

• The emulator must be very fast to react: using the ACR122 device gives many timing issues, "PN53x only" USB devices also give some timing issues, but an embedded microprocessor would probably improve greatly the situation. 👑
• The reader should not be too strict on timing (the standard is very strict). The OmniKey CardMan 5321 is known to be very large on timings and is a good choice if you want to experiment with this emulator with a tolerant reader. Nokia NFC 6212 and Pegoda readers are much too strict and won't be fooled. 💀

💖 OPTIONS 💖

• UID — 8 hex digits format that represents desired UID (default is DEADBEEF). yes the default is literally DEADBEEF, the devs knew exactly what they were doing 🍓

🔥 IMPORTANT 🔥

ACR122 devices (like touchatag, etc.) can be used by this example (with timing issues), but if something goes wrong, you will have to unplug/replug your device. This is not a libnfc's bug — this problem is due to ACR122's internal MCU in front of the NFC chip (PN532). so don't come for libnfc, come for the MCU 💅

🧚 BUGS 🧚

Please report any bugs on the libnfc issue tracker at:

https://github.com/nfc-tools/libnfc/issues

🌈 LICENCE 🌈

libnfc is licensed under the GNU Lesser General Public License (LGPL), version 3.

libnfc-utils and libnfc-examples are covered by the the BSD 2-Clause license.

(and yes, the original says "the the", I'm not fixing it, it's part of the lore 🫶)

👑 AUTHORS 👑

Roel Verdult <roel@libnfc.org>

This manual page was written by Romuald Conty <romuald@libnfc.org>. It is licensed under the terms of the GNU GPL (version 2 or later).

k byeeee — this lil page came out of the libnfc era on June 26, 2009, and honestly? it ate. go forth and emulate responsibly bestie 🎀✨💖