As already mentioned in my last blog post (NFC-Badge - Update your badge with your smartphone - Proof of concept ) the content of the ST M24LR or any NFC tg is usually formatted in the NFC Data Exchange Format (NDEF). I found it very hard to get the meaning of every single byte so I will post my summary here.
NFC Tag Type
There exist five different types of NFC tags. This is described at this website: https://www.dummies.com/consumer-electronics/5-nfc-tag-types/
From this website I also copied this image/table:
The M24LR is according to ISO 15693 so it is a Type 5 Tag (NFC-V compliant) or T5T.
NDEF
The data in NDEF devices is stored in one or more NDEF Messages of which each contains one or more NDEF Records. The NDEF Message is stored in a TLV Block. This is identical for every tag typ. Additionally each tag contains some information on size and formatting. For a Type 5 Tag this is called capability container (CC) and is stored in the first memory block.
I found most information in the following links:
https://learn.adafruit.com/adafruit-pn532-rfid-nfc/ndef
https://www.netes.com.tr/netes/dosyalar/dosya/B6159F60458582512B16EF1263ADE707.pdf
There exist different record types. The most widely used are text records and URI records. Text records are used to store text strings. URI records are used to store links and have some predefined link beginnings like "https://www." to reduce data length. For my NFC badge I use text records.
Example Content
Now I show the content of a NFC tag with one NDEF Message containing one NDEF Text Record.
This is the whole content in hex bytes:
E1 40 40 01 03 0F D1 01 0B 54 02 64 65 42 65 72 6E 68 61 72 64 FE
The rest of the eeprom is filled with 0x00 or 0xFF. But this doesn't matter.
| CC | NDEF Message TLV Block | NDEF Record | Payload | Description |
|---|---|---|---|---|
| E1 | Magic number, shows that the content is NDEF formatted. Always 0xE1 | |||
| 40 | Version and access condition Bit 7 and 6: major version Bit 5 and 4: minor version Bit 3 and 2: Read access: 0=always, 1=RFU, 2=proprietary, 3=RFU
Bit 1 and 0: Write access: 0=always, 1=RFU, 2=proprietary, 3=Never
so in this case: Version 1.0, read access always, write access always | |||
| 40 | MLEN - memory length multiply this value by eight to get the memory size. 0x40 x 8 = 64 x 8 = 512 bytes | |||
| 01 | additional feature information This byte is usually set to 0x01 | |||
| 03 | TLV Block tag field 0x03=NDEF message | |||
| 0F | length of the NDEF message 0x0F = 15 bytes | |||
| D1 | Record header 0xD1= Well-Known Record, SR=1 (length stored in 1 byte), ME=1 (last record in NDEF message), MB=1 (first record in NDEF message) | |||
| 01 | length of record type field | |||
| 0B | payload length 0B = 11 Bytes | |||
| 54 | Record Type 0x54=Text Record | |||
| 02 | encoding (UTF8) and length of language code (2 bytes) | |||
| 64 65 | language code "de" | |||
| 42 65 72 6E 68 61 72 64 | Text string "Bernhard" | |||
| FE | Terminator - Last TLV block |
The NDEF tag could also contain more NDEF messages or more NDEF Records. I hope the structure is now clear and additional records can be decoded using the links provided.
The content of the M24LR can be read out and also written via the I2C interface.
ST25 NFC Tap app
ST25 proposes to use its ST25 NFC Tap app to programm the M24LR. The app is available in the Google Play store: https://play.google.com/store/apps/details?id=com.st.st25nfc&hl=en_US
After startup the app shows this screen and wants you place a NFC tag near the reader.
When the M24LR si placed under the reader the app shows information on this device.
In the NDEF tab the previous described Text Record can be created.
The app can also show the content of the tag / eeprom just like it was described before
These screenshots show how the ST25 NFC Tap app allows to manipulate the M24LR. I suppose this is also possible with any app that allows to manipulate Type 5 Tags.
What's next
Next I will update the arduino code to fully decode the NDEF content and display the first text message.