The HydraNFC is a NFC shield hardware to sniff, read/write or emulate any 13.56MHz NFC tags (with the help of direct modes) for anyone interested in debugging/hacking/developing for NFC.

It has been designed to be used with HydraBus but can also be used with other MCU (breakout of all TRF7970A I/O).

HydraNFC is as powerful as Proxmark3 hardware (when combined with HydraBus) but smaller, autonomous, more extensible and without requiring an FPGA (all is done in CortexM4 MCU with the help of HydraBus with ultra fast unique algorithm to sniff & decode in real-time PICC/PCD NFC cards).

Features

HydraNFC shield:

•Pocket size and light weight

•Autonomous mode (when used with HydraBus) with 4 User buttons and 4 User LEDs

•Use Texas Instrument TRF7970A NFC chipset with full access to all pins and all modes of TRF7970A through connectors J1/J2/J3

•The device can perform in one of three modes: RFID and NFC reader, NFC peer, or in card emulation mode

•Supports Near Field Communication (NFC) Standards NFCIP-1 (ISO/IEC 18092) and NFCIP-2 (ISO/IEC 21481), completely Integrated Protocol Handling for ISO15693, ISO18000-3, ISO14443A/B, and FeliCa, integrated Encoders, Decoders, and Data Framing for NFC Initiator, Active and Passive Target Operation for All Three Bit Rates (106 kbps, 212 kbps, 424 kbps) and Card Emulation

•Programmable Output Power: +20 dBm (100 mW), +23 dBm (200 mW), programmable System Clock Frequency Output (RF, RF/2, RF/4) from 13.56-MHz Crystal

•Direct Mode 0: Raw RF Sub-Carrier Data Stream

•Direct Mode 1:Raw Digital ISO Coded Data Without Protocol Frame

•ISO Mode: Full ISO Framing and Error Checking (Typical Mode)

•Support external NFC Antenna with U.FL connector(cable included) or SMA

•Hardware licence CC BY NC (for commercial licence contact [email protected])

•Size: 54x35x13 mm

HydraNFC Antenna (included with HydraNFC shield):

•U.FL connector (cable included) or SMA (SMA connector included)

•High performance, can read Mifare card at up to 8cm (Tested with HydraNFC Shield only)

•Size: 58x53x4 mm

HydraNFC embedded firmware (requires HydraBus):

•Use SPI with SS mode for communication between STM32F4 & TRF7970A

•Virtual Serial Port access through microUSB with VT100 terminal/shell (compatible with any computer supporting USB Virtual Serial port).

Usage of ChibiOS (OS+Drivers) and microrl for VT100 terminal with history, completion and lot of other cool features

•Basic UID read for Vicinity/ISO15693 (through shell command)

•Basic UID read for Mifare One card (through shell command)

•Sniffer mode (NFC protocol analyzer) in autonomous mode for ISO14443A including both PICC and PCD with data logged to microSD card (tested with success with Mifare One NFC).

Sniffer is synchronized with TRF7970A CLK OUT (13.56MHz/4), use DMA double buffer to retrieve in real-time NFC raw bitstream, synchronize and detect (Tag/PICC=miller modified or PCD=manchester) protocol, decode it and format it in ASCII in less than 1us per bit, when user press a button the data are stored in microSD card (data can be also displayed in Terminal).

Example of sniffed output with a Mifare One tag read by a Nexus S phone:

TAG 04 00

93 20

TAG cd 81 5f 76 65

93 70 cd 81 5f 76 65 d1 86

TAG 08 b6 dd

...

Output format in this version:

When it start with 4 space it means Reader/Writer (PCD – Proximity Coupling Device).

When it start with TAG+1 space it means TAG(PICC – Proximity Integrated Circuit Card).

Data are in hexadecimal and only Parity is omitted (will be added later like on Proxmark3 with ! When there is parity error ...), also the CRC_A is not checked

•HydraBus microSD card to save or load data.

Support of microSD (FAT16/FAT32) card up upto 32GB (tested with SanDisk Extreme 32GB)

For more info and to get started with your HydraNFC, visit the HydraBus/HydraNFC website and for open firmware (HydraBus Required) or hardware for HydraNFC see github.