In order to relay data between two phones, we have to setup bluetooth communication so that two devices can open sockets to send stream data back and forth.

The model we implemented is a server client model. Either phone can be a server and the other will be the client. The server opens a socket and wait for request for connection. Once a request is received and confirmed, the server will close the listening thread and start a connected thread with an open socket to read/write data. For the client side, user will send out connecting request when it is within the range of another device. Once the request is accepted by the server, client can close the connecting thread and send the data through the socket the server provided.

Android developer site has some tutorials guiding through the bluetooth API. I basically just follow the example project and was able to set up a stable bluetooth connection. We have a text field where user can enter data to send. We tested our connection and it seems working fine. Essential bluetooth is just a util class in our application and the main program just need 3 interface:connect, read and write.

From Investigating the patch and the and android source code, we were able to figure out a little bit more about the details concerning NFC on the android.

These files are provided by nxp semiconductors to access the PN544 chip on the Android device. This represents the low level C NFC APIs.

root:
external/libnfc-nxp/src

phHal4Nfc.h
– general API header

phHal4Nfc_Internal.h
– internal structs used in nxp libs to pass around NFC context

phLibNfc_initiator.h
– initate nfc connection
– handle initial authentication protocol

phOsalNfc.h
– operatin system abstraction layer
– abstract away hardware specific components of NFC

phLibNfc_SE.h
– functions to access secure element on phone

phNfcConfig.h
– configure NFC chip

The below line is changed in the patch to enable card emulation

106 /**< Macro to Enable the Card Emulation Feature */
107 -/* #define HOST_EMULATION */
108 +#define HOST_EMULATION

phHal4Nfc_Emulation.c
– emulation libs in android

The following files provide the Java Native Interface that bridges the low level C API to the java interface exposed by Android.

Root:
packages/apps/Nfc/jni/

com_android_nfc_NativeNfcManager.cpp
– translate java to c library

Root:
packages/apps/Nfc/jni/src

NativeNfcManager.java
– high level nfc manager that broadcasts intents once an NFC event has been detected

NFCService:
– bridge between the NativeNfcManager and NFC events

Today, we were able to read data from sector 0 using existing NFC API in android.
Knowing the plaintext response from a sector of the MiFare is the key component in the latter part of our project in order to break the crypto 1 algorithm.

Crypto1 Algo:
Payload XOR KeyStream = Cyphertext

The idea is that the keystream can be kept constant because of the repeating nonce issue in MiFare Classic cards. If we also know the cyphertext and the payload, we can reconstruct the keystream.

Below is a brief trace of the actual response of the Q card.

Q Card
—————
SAK: 0x08
ATQA: 0x0400
ID: AA:65:8F:DB

Data
Sector 0
[00] AA 65 8F DB 9B 88 04 00
46 51 75 52 4D 10 13 08
[01] 20 00 54
..
[03] A0:A1:A2:A3:A4:A5 MAD access key
WxW 69:67:89 C1

Welcome to Blogs @ Rice University.

Either start blogging right away or take a few minutes to turn your blog into a normal web site!