Using cheap RC522 NFC reader to read Mifare Ultralight C

Mifare Ultralight C seems to be one of the most overlooked card types when secure cloning prevention is needed. It can only store 192 bytes of information, has just a single key and one counter. But the authentication sequence is the same as what the much more expensive DESfire uses. So I realized the commonly used DESfire is an overkill when I started looking into why single purpose autonomous building access systems are so expensive.

Just compare the prices (TME, VAT not included):

DESfire 2k - 0.96€ (100pcs)
DESfire 4k - 1.09€ (100pcs)
Ultralight C - 0.31€ (100pcs)

Plain Ultralight is even cheaper, but does not have any security at all (just couple of write once bits):

Ultralight EV1 - 0.24€ (100pcs)
NTAG213 - 0.23€ (100pcs)

I will add Mifare Classic pricing here as well, but remember the authentication there was broken about ten years ago so it can be also considered to be plain data storage medium only. It is not possible to prevent cloning, however there are systems that can detect cloned cards using a combination of ever increasing counter and a cryptographic signature (see for example here or here).

Mifare 1k - 0.18€ (100pcs)
Mifare 1k EV1 - 0.54€ (100pcs)

So here we have the Ultralight C card that is still secure and costs one third of the commonly used DESfire when cloning prevention is a priority.

An ideal candidate for a research project. Now, what about cheap reader/writer devices? There we have couple of popular options:

• NFC enabled Android phone (A)
• PN532 based devices
• Adafruit (B)
• Elechouse (C) and its clones (D)
• anonymous "Chinese" RC522 based devices (E)

All should be able to communicate with the card according to the chip datasheets. I ordered all the readers mentioned above and did some compatiblity tests with them. And the reality was a bit more interesting than expected indeed.

Some of the cards and tokens used for the tests

(A) My old Samsung Galaxy Ace 2 (i8160p) was able to talk to all the cards I have available (Mifare 1k and its clones, Ultralight C, DESfire and DESfire EV1). So I used it as a reference reader for my tests.


(B) Adafruit PN532 Arduino shield. PN532 is a high level chip that does all the basic ISO 14443-3 handling by itself and the application only needs to implement the card specific protocol. This is really well designed board that uses the chip and it reads all cards I have with no issues as expected. It is also the most expensive board in the test.

Adafruit PN532 Arduino shield in UART mode
connected to BusPirate

(C) Elechouse PN532 module V3. There are reports that it really is different from all its clones and should work properly with all Mifare cards. It is also PN532 based so the notes from the Adafruit board (B) apply as well. My tests confirm that. I had no issues reading DESfire and Ultralight C cards.

original Elechouse PN532 (notice the font used
for mode table at the lower left corner)

Back side of original Elechouse PN532, notice
the Elechouse name IS printed in italic and top edge
signal names have names

(D) Elechouse clone (Kkmoon) detected Mifare cards with 4 byte ID just fine, but it never noticed any card with 7 byte long ID - like DESfire, DESfire EV1 or Ultralight C. The same was reported for some other clones. I confirmed this behaviour by using both custom hardware (based on this project) and using libnfc tooling. nfc-tools issue #352 also confirms this behaviour.

KKmoon PN532 with reset signal wired to the top header

Back side of Kkmoon PN532, notice
the Elechouse name is not printed in italic

(E) The cheapest reader was an RC522 board I bought locally (GMe 772-164). It was able to read Mifare 1k just fine, it also detected DESfire when the card was almost touching the antenna but it never noticed the Ultralight C card. 

RC522 board with replaced parts and a custom clearance hole

All NFC cards need a certain strength of the electromagnetic field to properly activate. The reading distance using the unmodified board is pretty bad for all cards and Ultralight C can't be powered at all. There are lots of questions on the internet about how to improve the reading distance when using this board. Sadly, answers are either horribly wrong (RC522 can't support 3DES cards), just wrong (can' t read this card type with Arduino Uno), or focused on the software stack only (increase receiver sensitivity using the built in register).

RC522 board connected to TI Stellaris Launchpad I just had lying around. It was running a modified
https://github.com/miguelbalboa/rfid/blob/master/examples/DumpInfo/DumpInfo.ino sketch

I only needed to realize (and read the datasheet) that the RC522 chip does not provide any real high level capabilities. It only manages the RF field and does modulation/demodulation of the signal (up to ISO 14443-2). All ISO 14443-3 collision resolving and higher card protocols have to be done in software. This means the chip can support all cards it can talk to using the supported frequency and modulation and that includes the Ultralight C. So the issue is not there.

It turns out the design of the board is sound, but the component selection is poor and tuning is not perfect. This was discovered by the only single person I have seen in all the forums to investigate the RF design and component selection of that board. Thank you ermok!

Now, the fix that is needed to make this board a good performer is supposed to be very simple. There are two inductors on this board that are of the right nominal value (2u2), but are simply unfit when you take a look at their current carrying capability and operating frequency. Replacing them with a properly rated inductor increases the current that can flow through the antenna and that increases the generated electromagnetic field which should allow the card to properly power up.

Replaced inductors
(pay no atention to my soldering, I had little time and only crude tools)

The other change needed seems to be replacing two tuning capacitors (0805 SMD size). Changing the value from 47p to 33p (using ceramic chip C0G capacitor) should improve tuning and that should increase the field strength even more.

Replaced capacitors (33p 0805 C0G ceramic)

I decided to give it a try since I wanted to use Ultralight C cards and the reader was so cheap (about 8€) so I was not afraid to break it. I ordered the recommended set of inductors (FERROCORE CW1008-2200 - 1.26€ per 10 pcs), used hot air to remove the old parts and soldered the replacements. And guess what.. suddenly the reader recognizes Ultralight C cards just fine. The reading distance is not great, but good enough for the close proximity based access control system reader.

So a simple sub-1€ fix was enough to make this cheap board into a proper and usable reader (and writer). The question now is.. can the same procedure be adapted for the PN532 boards, or is the issue there more substantial (like a counterfeit PN532 chip)?

Portable station above 1000m ASL with small transmitting loop

I went to Orlické hory for the last weekend. That was a great opportunity to test my small transmitting loop antenna. Count in the chance of making my first SOTA activation ever and you get a perfect motivation. On the other hand, the main purpose of the trip was a (geocaching) weekend with my family. That always means limited air time.

The antenna was a small transmitting loop made out of 3 meters of Aircom+ coax cable. The diameter was about 1m and the tuning capacitor (YO3GGX used the same type) was connected to it using a pair of gold plated N connectors (to make it easily transportable). If there is something familiar about this design it is because it is close to the well known Alex loop.

The design spreadsheet with numbers is here (I used AA5TB's spreadsheet updated to use metric units and converted to LibreOffice): aa5tb_loop_v1.22a_metric.ods

Check the simulation on the images here. I did not add any loss resistance so it shows an ideal antenna with the entered proportions. However the connectors add some loss so the real performance is "a bit" worse:

The tuning box consists of the variable capacitor and a motor (5Vdc, 16rpm). The two sections of the capacitor are wired in series and form a split arrangement to double the voltage rating and remove the loss of wiper contacts.

Unfortunately I do not yet have the necessary handles for the axles and so the motor was not utilized in this experiment. The plan is to use a belt and two pulleys of different diameter to make the turning rate even slower.

The antenna element is supposed to be supported by three 40cm long PVC tubes and should hold the almost circular shape well thanks to the Aircoms' solid core conductor.

The missing piece is the driven element. That is a small loop (1/5 of the main loop's diameter) I created out of RG-58 coax cable by connecting the end of center conductor to the outer braid half a meter away and making sure the braids do not touch at that point. I left about 10m of the cable going away from the connection point and added BNC connector to the end. That makes my feedline.

Now with this done I was almost ready to transmit. I packed everything for the weekend except one small thing... Ferrite core to use as a base for balun. Five loops of my feedline through that core make the common mode impedance about 1500 ohm @ 10Mhz.

Just before we started our trip to Velká Deštná (OK/KR-008, 1115m ASL) I forgot to pack the PVC tubes that were supposed to hold the shape of my loop. Oops..

Fortunately, we found a nice straight dead tree branch to use as support and my son provided me with a fastener circle from his toy. After this hack I connected my VNA to the feedline, watched the graphs on my cell phone using BlueVNA app and played with the capacitor. Tuning by turning an axle with fingers is no fun, but I managed to get the center frequency to about 14,250Mhz.

I then connected the radio and listened for a while... well I was not happy to hear so much traffic and noise. Apparently there was a contest going on. Not much chance for me to call CQ with only 10W and SSB mode.

My first attempt on contact in that situation was therefore a sked with OK2JRQ. I could barely hear his signal (QTH Brno, CZ, 100W), but since I operated with much lower power, he could not hear mine...

Luckily I heard a CQ from a british special event station GX3EFX operated by Mike. After several attempts to get my callsign right he gave me a report of 44 due to a lot of noise coming at him from Europe. So my thanks to Britain.

Then it started raining so it was time to pack the equipment and resume the trek. I never managed to do the required four contacts for SOTA activation, maybe next time.

Overall it was an interesting attempt and I will be trying the antenna again for sure.

Remote symmetric matchbox - part 4

I finally completed the matchbox and did some preliminary testing with my network analyzer.

The remote part was inserted into a waterproof box and all external connections were waterproofed by using pigtails that go through water-tight cable sleeves.

The external connections are:

• 2x connection for symmetric antenna (black connectors on red wire)
• asymetric RF input (pigtail with N female)
• power (red and black wire with connectors)
• control (UTP cable with RJ45 connectors, waterproofed by candle wax)

Almost completed matchbox in waterproof box.
The only piece missing is the waterproofed RJ45 pigtail.

There are two things I would like point out before I continue:

One component that was not described before is the input balun. To suppress the common mode current effectively the balun has to be on the low impedance side and that is the RF input. Look at the middle bottom of the coil board and you will see two coil wires entering a black cylinder with white rims. That is a set of five T50-43 toroid cores with 3 bifilar turns. The design impedance was about 500 ohms at 3.5Mhz.

Another change I had to do was to solder a second inverter (74ACT04) on top of all the inverters I had on the relay driver board to boost the current capability. Driving two relays (coil switching) in parallel needed more juice (34mA) than a single output was able to provide.

Now back to the testing…

After I assembled the whole box I connected it to my miniVNA and used 1000 ohm power (5W) resistor as a dummy load. I then checked that I am able to tune it to look like 50 ohm load.

I was able to do it, but I quickly realized that I have made a mistake in the capacitor bank's relay wiring and the value I am sending over the control line has to be inverted (oops..). The coil switching is not affected by this as I fixed the polarity during PCB layout phase.

So currently the control signal contains the following bytes:

1. byte ignored
2. coil inductance; 0uH = 0x00, max uH = 0xff
3. capacitor capacitance; 0pF = 0xff, max pF = 0x00

I again used Bus Pirate for sending the SPI as I do not have the control box ready yet. All bytes were sent using 30kHz SPI with most significant bit first.

The command that matched 50 ohm output of the VNA to the power resistor was

SPI>[0x00 0x1e 0xe9]

and the resulting values were close enough to the values predicted by SimSmith (about 100pF and 4.9uH). Check the two following images to compare:

Predicted impedance tuning in SimSmith

Measured impedance during step-by-step tuning

You might notice some small back-jumps in the tuning sequence. Those happen at places where multiple bits change (for example 0x0111 to 0x1000) and mean that the MSb coil does not have the full inductance of the three lower bit coils combined. Also the trajectory does not exactly follow the proper Smith chart lines which means there are some parasitic properties associated with the tuning elements.

In case you wonder what software I use to talk to the Bus Pirate's serial interface then the answer is Cool Term when I am on Mac and minicom when I am using linux (Fedora in my case).

I hope I will get to connecting this matchbox to the antenna soon so I can evaluate the real world usability.

Remote symmetric matchbox - part 3

The last batch of PCBs finally arrived. So.. here I present you with the coil switching board for the symmetric matchbox.

As you can see the board is symmetric, but can be cut in half if that is needed. I have couple of

extra and might use them for some other similar project that won't need both sections. 

PCB for coil switching board

The design inductance was 0 to 16uH per section in 256 steps. So I wound the coils on the Txx-6 cores that are good for HF signals (10-40Mhz). I used 0.6mm diameter enameled copper wire to make sure the biggest coil fits the core (42 turns).

Check the winding table below:

L [uH]	core	Al / 100t	turns	Lr [uH]
0,06	T50-6	40	4	0,064
0,125	T50-6	40	6	0,144
0,25	T50-6	40	8	0,256
0,5	T50-6	40	11	0,484
1	T50-6	40	16	1,024
2	T68-6	47	21	2,073
4	T68-6	47	29	3,953
8	T80-6	45	42	7,938

Populated coil switching board

Remote symmetric matchbox - part 2

I finally got to soldering the PCBs for my tuner. Here is the picture of the result hooked up to my Bus Pirate for testing:

Bus Pirate hooked up to control boards and capacitor bank board.
From the left side: Bus Pirate; SPI to UTP convertor; Capacitor board; UTP decoder and 3x8 relay driver board

The capacitor board can switch in capacitances between (design values) 3.7pF and 947pF.

It consists of 8 binary switched banks where each bank has three sections in series (to increase breakdown voltage) with two caps in parallel in each (to improve current carrying capability). All capacitors are zero temperature coefficient (NP0) ceramics rated for 500V.

bank	total	section 1	section 2	section 3
1.	3.7pF	2x 5.6pF	2x 5.6pF	2x 5.6pF
2.	7.5pF	2x 10pF	2x 12pF	2x 12pF
3.	14.7pF	2x 22pF	2x 22pF	2x 22pF
4.	30.3pF	2x 39pF	2x 39pF	2x 68pF
5.	57.6pF	2x 68pF	2x 100pF	2x 100pF
6.	120pF	2x 180pF	2x 180pF	2x 180pF
7.	231.9pF	2x 330pF	2x 330pF	2x 390pF
8.	480.7pF	2x 680pF	2x 680pF	2x 820pF

Once I (create and) connect the toroid board and input balun, the tuner will be ready for field testing.

First QSLs received through buro

I have just received my first two way QSL cards through buro. It took only half a year :)

Couple of months ago I also asked for one QSL to be delivered direct as it was my first contact with an Asia station. So here it is.

Remote symmetric matchbox

Here is my second attempt to create a symmetric matchbox for my QRP purposes. I quickly realized that it is quite annoying to run to the antenna to retune after a frequency change. So I decided to create a remote matchbox based on my previous manual one.

There are some commercial balanced matchboxes. The single remote one (HamWare AT-615B) is VERY expensive and uses a lot of control wires.

When I saw that I decided on three main design goals for my prototype:

• no micro controller on the antenna side
• immunity to interference
• simple wiring

So I started thinking about the control interface and realized that if UTP 5e is good for 100 meter long lines up to gigabit speeds it must surely be good for low frequency as well. UTP gives me four differential pairs to use. SPI then needs four wires and can control a shift register directly. This combined will allow me to reuse my stash of UTP 5e cable and connectors and when I do not have any more UTP is quite cheap anyway.

Here are the first steps I took.. schematics and PCBs. I could have used ground plane construction, but I was a bit worried about the capacitance it would create.

I have already mentioned that I am using SPI as the control protocol and here is how I envision it to work:

• A micro uses SPI to send 24 bits over to the tuner. Each bit controls one bipolar relay, together they control three sets of eight relays each.
• Each SPI signal is converted to a differential pair (5V/0V levels) to prevent interference and transfered in that form to the tuner side controller. Each signal is using one twisted pair in the UTP cable.
• At the tuner side the pair is decoded to SPI signals again and those are connected to three 74HC595 latching shift registers (24 bits).
• The shift registers hold the control value and pass the bit values to 74ACT04 invertors that drive the bipolar relays (FTR-B4).
• The ACT family can source or sink more than 20mA per leg. That is more than enough to switch the state of my relays.

Transceiver side controller - SPI to UTP

Tuner side controller - UTP to relay controller lines

The controller boards use AM26C32CD receivers and ST26C31B drivers. I know I am wasting one perfectly good receiver/driver, but I have quite lot of those in my stash :)

The characteristic impedance of UTP twisted pair is 100 ohms, the same as the output impedance of the ST26C31 driver (see Table 6 in the datasheet). For that reason there are 100 ohm terminating resistors just before the receivers.

Coil switching board

Capacitor bank board

Coil and capacitor switching circuits are not special at all:

• Coils are connected in parallel and single coils can be bypassed by the respective relay.
• Capacitors are organized into banks where each bank can have 16 capacitors - four parallel capacitors four times in series to make the bank withstand higher voltages (I have assortment of 500V NP0 capacitors).
• All relays are bipolar (latching) Fujitsu FTR-B4 4.5V with 17mA latching current. I am only using QRP power so the current carrying capability (1A per section and I wire both sections in parallel). I am using the same trick to drive them as in my manual matchbox from the previous article.

I am planning to use balanced-Pi configuration and haven't decided on the capacitor values yet so I planned for the worst case. I won't probably be populating most of the capacitors. All of them will be the NP0 kind though (zero temperature coefficient).

Panel with controller boards (tuner and trx sides) + one unrelated micro-controller board

Two capacitor bank boards with relays

The boards were made by Seeedstudio and it took about a month to get them. I was busy during that time so it was not really holding me back.. but I am glad I have them at home. You might have also noticed that there is no board for the coil part. That is because I am planning on reusing the board I already have in the manual matchbox.

That I all I can describe today as I haven't started soldering yet. Once I have a prototype ready, I will post the results.