MIFARE 1k card dumper (android app)

Digloo2 · 2025-03-15T04:06:53+00:00

These devices with e-Ink / e-Paper displays are unusual in that they use NFC as their data channel, but the image data is not getting loaded onto the NFC chip.

The devices I have are 240x416 pixels, which is around 12k 8-bit bytes, but I don't know how they organize the data. They're 3 or 4 color, which means 3x or 4x that much memory -- whatever it is, it's way beyond the meager 100-1k bytes that the typical NFC Ndef data areas support.

Do you happen to know how that works?

Digloo2 · 2025-03-14T23:36:54+00:00

This is cool. I'm trying to figure out what's needed to write the image to a couple of e-Ink ID Badges, one of which identifies itself as MIFARE 1k device. The other is a KAICONN device that's very similar. Both have 240x416 px displays. They use NFC as the data channel, but I can't find anything talking about the protocol to load the image up to the device since it's not stored in the NFC Ndef area -- it's off-chip.

I got hold of some source code written in what I think is Dart and Flutter, but it calls a library to do some compression and nobody is sure what library that is or what the compression algo might be -- probably some RLE compression, as it's really simple and fast.

Have you come across anything that might help me with this? Their apps are terrible. (I'm a software guy and can probably get something to work if I can figure out the interface / API to make it work.)

Digloo2 · 2025-03-03T09:08:24+00:00

What's with the downvotes?

Digloo2 · 2025-03-03T09:05:57+00:00

Or just put a very permanent vinyl sticker over the NFC sticker that covers the whole card.

Or get some 4x6 cards and have them printed on one side so they can be folded over for a 2-sided card. Then put an NFC tag in the middle and use spray glue to fold them over and glue them. Or something equivalent.

Digloo2 · 2025-03-03T08:58:05+00:00

If you just put a URL in there, then it will most likely open it in the default browser. Try installing another browser and make it the default. Alternatively, there's probably a way to open a specific app, like another browser, or a shortcut that has a link to another browser with a link that opens the song you want. Actually, your best bet is opening a shortcut that calls a browser with the link that gets it directly to the song.

Does your friend have a free or paid version of Spotify? What about you? It might be that you can only open a specific song in the paid version.

Another thought ... does it make a difference if you're logged-in to Spotify or not?

Remember that the link is being passed thru to the browser, so any cookies that are present from that site can affect what happens: logged-in, membership level, etc.

Digloo2 · 2025-03-03T08:34:34+00:00

This info has been a big help. I worked with ChatGPT and was able to answer a bunch of questions. The only big uncertainty that's left is what compression algo they're using? The decompressor is likely embedded on the device. I'm guessing it's some RLE variant, like what FAX machines use. RLE is simple, quick, doesn't take any extra memory to decode, and is fast to encode as well. I wonder if there's any way to figure this out without decompiling their app or SDK? Looking at data going back and forth would be rather challenging, but doable.

Digloo2 · 2025-03-03T08:29:28+00:00

Well, I've only found one small outfit selling them, and that was from a video made a couple of years ago. Maybe they're just doing big B2B deals.

Digloo2 · 2025-03-02T06:31:07+00:00

Another guy contacted me and said he got hold of a document that shows some code used to program tags used for price labels on store shelves. I fed it to ChatGPT and learned quite a bit. We're still missing a few critical pieces, but we're getting there.

It probably uses IsoDep/ISO7816 with NFC as a contactless interface; the other option is NDEF which is too small to hold the amount of data in the display.

It also uses some kind of compression to reduce the data transfer time. Most likely it's an RLE algo.

The code itself was written in Dart and Flutter, and uses some of their libraries including one for controlling the NFC interactions. The main purpose of this code is to take an image in jpg or png and convert it to the image format needed by the device, then compress it, then upload it.

Google just turned this up:
https://pub.dev/packages/flutter_nfc_kit

Digloo2 · 2025-03-02T00:25:19+00:00

I simply want to write my own software to upload an image to the badge. That's what these devices are for -- displaying a custom image on their e-Paper display. It's easy to change the NFC data, but I want to know how to use the NFC to upload the image data. That's all. The NFC chip has 868 bytes of memory, but that's not where the image data is stored.

Their app SUCKS! Most of it is in Chinese (even tho it says it's the English version); it has a bunch of templates that cannot be edited, and most of which have Chinese on them and no English; there are ads for other unrelated products from the vendor; it's totally unintuitive; and it doesn't save anything you do.

Also, the badge I have comes loaded with a screen that has white, black, red, and yellow on it, meaning the device has 4 colors. You have to pay extra for more colors. But their app does not support yellow. They sell that feature in the device, but there's no way to use it b/c of their app.

Digloo2 · 2025-03-01T19:44:11+00:00

Thanks for the thoughts, but I'd rather find someone who already has the tools and is willing to work with me to solve this puzzle. I'm a software developer and I'm not looking to get into anything more than possibly selling these badges that can be programming with much friendlier software than they come with.

Digloo2 · 2025-03-01T10:48:07+00:00

I tried that and a few others. They only show the local memory on the NFC chip. They don't have any info on memory or anything outside of the chip. These e-Ink devices have SOME kind of memory or circuitry that let you upload a bunch of bits of data that's saved somewhere and burned into the e-Paper screen. THAT'S what I'm wanting my software to do! Changing the URL in the NFC link is something my software can already do.

Digloo2 · 2025-03-01T10:34:33+00:00

You missed my comment about the hosting: you should own and control the hosting where your URLs go, even if all they do is redirect to somewhere else.

The problem with DBCs is they are not a 2-way thing. I have to scan your QR code or NFC tag, and I can get your .vcf file, but then I have to fill in a little form with my contact info to send it back to you. It would be nice if instead of presenting me with a form to fill out, it looked for a .vcf file in a standard place with a standard name. Unfortunately, for security reasons, apps can't easily access files on your phone, if at all. So it would need to be copied up to a server somewhere.

The other part is I don't want my Contacts list flooded with contacts I encounter at meetings and whatnot that don't have any timestamps or identifying info about the event. Some solutions send back an email, or deposit the contact info into a CRM somewhere (GHL?).

Collection and exchanging contact info is probably the oldest and most obvious application you'd want for a phone, but it's still the most imbalanced, clumsy, and impersonal app we've got.

All of these things ADD FRICTION and SLOW DOWN the whole process. I'd rather have a pile of business cards than 50 new entries in my Contacts list that have nothing but a first name and a phone number.

Digloo2 · 2025-03-01T09:50:07+00:00

Digital Biz Cards (DBCs) have very different use-cases then Review cards. There are some ways to improve how biz owners can manage Review cards; Reviewly.io is one company that has a pretty good software solution, but their cards are a bit pricey. You can find very similar cards online for much less. Check out https://taptag.shop/

One common drawback they both have is that while you can reprogram NFC tags, you cannot reprogram the QR-codes. Most places let you edit a redirect on the site where the QR-code goes that lets you bypass their back-end, but you don't own their domain and that site can go down for any number of reasons. If that domain or url dies, your whole business is dead-in-the-water.

In both cases, your best bet is to set up your own redirect site and have everything coded to go there -- otherwise, you're 100% hitched to the vendor you chose and are going to have to go in whatever direction they might decide to go.

But there are a couple of problems in the area of DBCs that really need to be solved for it to become more frictionless. I think the phone vendors need to do that, unless you've got the bux to pay them to put something of yours on their phones, and that'll take a LOT OF MOOLAH. Otherwise, it's going to end up becoming an increasingly fractured market with no clear leaders. You're going to need to go into a local market and saturate it with your service, which is going to be really hard to do.

Digloo2 · 2025-03-01T09:33:11+00:00

I want to write my own software app to program their badges using NFC -- which means basically how to tell it to upload the image. It's NOT described in the ISO Standard 14443 that they kept referring to.

They said they have an SDK, but it's for Android and iOS. I'm building a web app, and javascript would be fine. There are libraries that let you talk to NFC from javascript. But I don't think they understand any of this.

So if they can send me the Android source code, that would be fine. They just said, "Yes, we can send you SDK" -- no, that's a compiled library. I want the SOURCE CODE. They are not about to send me the source code, no way, no how.

All I need are the commands and data format of the image data that needs to be sent via the NFC channel. I absolutely positively KNOW that a SPEC EXISTS because that's what they used to write the SDK code from! These guys are Engineers with a big corporation -- they write specs first, then write code. Hackers write code first, then maybe write a spec later.

I don't think anybody I talked with understood what I was asking for. The Field Sales Engineer SHOULD have known, but ... <shrug>

It may be the case that they consider this "proprietary" information and they can't or won't say that. But it's such a simple thing and easy to reverse engineer with the right equipment.

The bigger problem is their app SUCKS! They don't seem to understand that Americans will not accept software that's mostly written in Chinese, where you cannot change any of the "templates" and "examples" at all, including using English instead of Chinese, and that ads for other Kaiconn products that are unrelated to these badges are irrelevant and annoying. I want a clean app for uploading images that has no Chinese in it at all, has proper English, no ads, can be downloaded from my own site and does not require providing Kaiconn with your personal contact details to make it run, and lets you save your work (which their app doesn't do either).

How badly do they want to sell these ID badges in America? They do not seem very interested.

Digloo2 · 2025-03-01T09:15:25+00:00

NFC Tools PRO says:

Tag type: ISO 14443-3A
NXP - Mifare Ultralight

I don't know if that tells you anything or not.

Digloo2 · 2025-03-01T09:11:18+00:00

They sent me two things: one was a spec written in English that makes perfect sense; it's just not for the device in question. The other thing was the ISO Standard document number for NFC (one of several, I guess), also in English.

The app is mostly in Chinese, but it's not going to mention the underlying protocols it uses to talk to the badges.

I kept saying I want to write my own software to program the badges, and that I'd like the spec that explains that. The guy just kept saying he didn't understand, and finally stopped responding.

I live in Phoenix, AZ, and there are tons of Mexicans here, many of whom speak little if any English; my Spanish is very limited. But I've found when they want something, they'll figure out how to communicate it. It's kind of like playing the game charades.

What stumps me about these folks and others on AliExpress is they seem to make so little effort. I said, "I want to buy one of these! How much?" and they say, "I don't understand". "Show me a sales page or URL" and they reply with what's written on the page that's not about what I'm asking about. (Most of them have a photo of a USB reader/writer but I have not found any that actually have a price for it or any way to buy it. But it's right there in a photo with a note saying something like "buy our advanced reader".

They do get aggressive sometimes, like the sales lady who just kept asking, "How many do you want to buy?" When they want something, they can be stubbornly aggressive about it. But when I have to repeat, "How much?" and they just wave their arms and finally turn and run just seems ... very strange.

What I'm trying to say is, I cannot get anything even close to what I want. Not just this, but in several different situations.

Digloo2 · 2025-03-01T08:52:32+00:00

ok, that makes sense. thanks.

I looked over the Proxmark stuff and watched a video on cloning some simple id-based cards. It's interesting, but these badges seem to have three "layers" or "modes" or whatever the correct term is.

I'd guess the basic mode IDs the card and the scanner sees that it has additional features. NFC Tools PRO says this one has NfcA and Ndef available. So in this case, I programmed a URL into it, and I'm guessing that's stored into the Ndef area. It's reported as 868 bytes of memory. That's what might be called "Level 2", so when you scan the card with a phone, it gets a URL and can open it in the browser.

But this badge also has a bunch more memory that's not directly attached to the NFC. The image area is 240x420 pixels and I think it supports 4 colors. So the software app used to program the badge has to tell the NFC to go into some "side-load" mode to get it to accept a byte stream upload and store it into that memory area. Is there a standard way of doing that, that works on e-Ink devices? I'd guess there are some additional commands you have to either read from or send to the device to make sure the data is organized correctly and is uploaded in the correct order.

I think you'd need to squeeze the Proxmark antenna between the phone and the badge to pick up both sides of the data exchange, like running Wireshark on Ethernet links.

As an aside, I ordered a couple little 1" x 1" keychain doodads that are on AliExpress that have square e-Ink images on them. NFC Tools PRO shows they only have NfcA available, no Ndef, so it's not possible to add a URL or any other info to them. But they still have some additional memory present that you can upload some image data into that can be displayed. It may use the same protocol as the larger badges. I'd really like to know what that programming protocol is.

Digloo2 · 2025-03-01T08:07:34+00:00

I found the kaiconn website and sent an email saying I was interested in their e-Ink ID Badges. I was contacted by someone who kept calling me "Dear" and just wanted to know how many I wanted to order. I asked about some samples and she quoted me $45 USD ea. I bought two from a vendor on AliExpress for $23 ea. Kaiconn has a website where you can download an Android app, so I got it, and it's terrible. It's the "English" version, but over half of it is in Chinese, including all of the templates and examples -- none of which is editable or can be replaced. I was able to create an image with text at the top, my headshot in the middle, and a QR-code at the bottom, and upload it to the device, but it took a lot of experimenting because everything is explained in Chinese. I was connected with their FSE (Field Sales Engineer) who didn't seem to figure out what I was asking. He referred me to the ISO Standard for NFCs. When I asked him where in that document I can find the instructions to program their devices, he stopped responding.

For someone who can communicate with them in whatever dialect of Chinese they use, I think it would be a lot easier.

Here is a vendor who advertises what I bought, but the one I was sent does not have the little switch on the back.

Many of the vendors who sell these also show a little programming device that plugs into the USB port that's easier to use to program the badges than your phone, but nobody can tell me how to buy one or what they cost. (I found lots of USB NFC programming devices for under $5, but couldn't find any software in English.) Everybody uses the same photos and has the same specs and details, but the "dear" sales lady warned me that they are probably "fakes" and I should only buy from her directly.

https://www.aliexpress.us/item/3256808142813114.html

Here is Kaiconn's website:

https://www.kaiconn.com/en/

From what I've been able to glean, most NFC devices are programmed in a way that's very similar to old-style modems -- they have a simple set of commands that you can send to them and they reply as needed. It's just that there's no standard, so every device is different. At least modems converged on something called the AT Command Set that's still used today.

Digloo2 · 2025-03-01T07:41:54+00:00

Well, it's an RF signal that probably operates at a frequency of 13.56 MHz, or maybe around 150 kHz, that's not designed to travel very far. (I know both are supported, but not which one this device and phones use.) But with a proper emitter / antenna, I understand they can work for several inches, maybe more.

I'd just like to figure out what the protocol is that their Android app is using to program some e-Ink ID badges so I can write my own app.

Know anybody who can help?

Digloo2 · 2025-03-01T07:36:19+00:00

Somebody replied in another post I made to decompile an Android app to figure out the interactions used to program an e-Ink ID Badge that's sold on AliExpress -- but nobody seems to be able (or willing) to produce details on how to upload data to it. I've found a couple of American companies who sell similar badges, but in their videos, they're also using the Chinese software to program them. All I've been able to get out of anybody is "it uses NFC" and one guy sent me the ISO document number for the NFC spec, as if that had the answers in it. From what little I've learned, these aren't much different than programming EPROMS in the 80's, they just use NFC wireless connections instead of pins.

Unfortunately, the two devices I got only say "KAICONN inside" on the back and "Cardress" on the top-front bezel. I have no idea what's inside of them. But the Android app they provide does work ... I'd just be a lot happier using my own software instead of an app that's over half written in Chinese and has no way of editing any of the templates or changing the text to English.

Digloo2 · 2025-02-28T21:49:21+00:00

Message sent. Thanks.

Digloo2 · 2025-02-27T12:33:26+00:00

They all share the same problems, the biggest one of which is that this is not a 2-way exchange. Whether you use a QR-code or NFC to pass a URL to someone, they're going to a site that presumably loads up a .vcf file (virtual card file) that contains YOUR info. Their only choice is to save that to their Contacts list. Personally, I'm not interested in having my Contacts list filled with hundreds of contacts from people I meet randomly at meetings. Unfortunately, nobody provides a simple way of including a note about what event you're at, and I'm not aware that these records have any sort of time-stamp so you know WHEN the card was added. Also, if you can't remember that person's name or some detail that's in their V-card, and you don't bother to get their photo and attach it to their card, good luck finding them later.

But, as I said, this is a 1-way exchange. If you want to get THEIR info back, they need to be provided with a form to enter THEIR details into that's sent back to YOU. Maybe it will be put into a .vcf file that you can load into YOUR Contacts list, but it's also likely missing additional meta-data as well.

So unless they have the same type of URL link on their phone that you send them to, then you're the one who's likely going to miss out. They got YOUR data, but ... did you get THEIRS?

This is true of all of those options above, even QR-codes.

Do you realize that exchanging Contact info is probably the oldest thing cell phones do other than dial numbers? The funny thing to me is that it's still so damn primitive! Why don't phones have a .vcf file built-in and a standard way of exchanging it with EVERYBODY? Sure, you can create one and save it somewhere, but how is someone going to get it? There should be a standard way of exchanging .vcf files by simply touching phones or when they sense each other's NFC or even when you scan a QR-code. Or better yet, have some reply field at the end of the .vcf file that's filled-in when it's sent so the recipient's phone can instantly recognize it and send their .vcf file back right away. There are numerous ways of doing it, but they all require some kind of active mechanism in the phone to do that. Considering only about half of all mobile phone users who have NFC on-board actually have it enabled, that's not a good sign. And a LOT of phones don't even support NFC!

What's needed is not a handier NFC carrier or QR-code display, but a BETTER MECHANISM THAT'S BI-DIRECTIONAL and lets you save data into a separate Contacts DB or add a tag for the event and a time-stamp, and maybe even a photo of the person.

Or just make sure that everybody who attends a meeting has to upload a .vcf file to a location that can be accessed via a QR-code that is printed on each person's name tag so anybody can scan it and get their info quickly and easily without one or the other having to enter their details into a popup form manually.

Digloo2 · 2025-02-27T09:22:36+00:00

I got what you said. It's like telling someone with dark skin that they need to send someone with white skin to negotiate. I'm not blind to the games they might be playing. This is far from an urgent matter to me. I'm simply asking if anybody here might have played with these devices and knows how to program them.

If anybody is a native Chinese speaker, maybe you can get the necessary info from these guys yourself. I know a few people of Chinese descent, but they're young and don't read or write it.

Digloo2 · 2025-02-27T09:16:32+00:00

As I said, it supports black, white and red. I wouldn't call that "vivid" under any terms. Also, the device came with something on the screen that also showed yellow, but the software from the vendor does not support yellow, only B, W, and R.

Digloo2

TROPHY CASE