NFCGate is an Android application meant to capture, analyze, or modify NFC traffic. It can be used as a researching tool to reverse engineer protocols or assess the security of protocols against traffic modifications.
Notice
This application was developed for security research purposes by students of the Secure Mobile Networking Lab at TU Darmstadt. Please do not use this application for malicious purposes.Features
- On-device capture: Captures NFC traffic sent and received by other applications running on the device.
- Relay: Relays NFC traffic between two devices using a server. One device operates as a "reader" reading an NFC tag, the other device emulates an NFC tag using the Host Card Emulation (HCE).
- Replay: Replays previously captured NFC traffic in either "reader" or "tag" mode.
- Clone: Clones the initial tag information (e.g. ID).
- pcapng export of captured NFC traffic, readable by Wireshark.
Requirements for specific modes
- NFC support
- Android 5+ (API level 21+)
- Xposed-compatible hooking framework (EdXposed, LSPosed with Zygisk or Riru): On-device capture, relay tag mode, replay tag mode, clone mode.
- ARMv8-A, ARMv7: Relay tag mode, replay tag mode, clone mode.
- HCE: Relay tag mode, replay tag mode, clone mode.
Usage
Building
- Initialize submodules: git submodule update --init
- Build using Android Studio or Gradle
Operating Modes
As instructions differ per mode, each mode is described in detail in its own document in doc/mode/:Pcapng Export
Captured traffic can be exported in or imported from the pcapng file format. For example, Wireshark can be used to further analyze NFC traffic. A detailed description of the import and export functionality is documented in doc/pcapng.md.Compatibility
NFCGate provides an in-app status check. For further notes on compatibility see the compatibility document.Known Issues and Caveats
Please consider the following issues and caveats before using the application (and especially before filing a bug report).NFC Stack
When using modes, that utilize HCE, the phone has to implement the NFC Controller Interface (NCI) specification. Most of the phones should implement this specification when offering HCE support.Confidentiality of Data Channel (relay)
To ensure confidentiality and integrity, use Transport Layer Security (TLS), which can be enabled in NFCGate settings. You need a CA-issued or self-signed certificate. Certificates from system-trusted CAs are trusted automatically. Self-signed certificates can be trusted by the user on first use ( TOFU).Compatibility with Cards (relay, replay, clone)
We can only proxy tags supported by Android. For example, Android no longer offers support for MiFare classic chips, so these cards are not supported. When in doubt, use an application like NFC Tag info to find out if your tag is compatible. Also, at the moment, every tag technology supported by Android's HCE is supported (A, B, F), however NFC-B and NFC-F remain untested. NFC-A tags are the most common tags (for example, both the MiFare DESFire and specialized chips like the ones in electronic passports use NFC-A), but you may experience problems if you use other tags.Compatibility with readers (relay)
This application only works with readers which do not implement additional security measures. One security measure which will prevent our application from working in relay mode is when the reader checks the time it takes the card to respond (or, to use the more general case, if the reader implements "distance bounding"). The network transmission adds a noticeable delay to any transaction, so any secure reader will not accept our proxied replies.This does not affect other operating modes.