How to programmatically detect the memory size/page number of an NFC chip - tags

Question

What is the easiest way to programmatically detect the memory size or page count of an NFC chip (MIFARE Ultralight or NTAGxxx) other than probing for specific page numbers and checking if they exist?
Is there a specific byte in the ATR returned or somewhere stored in the protected zone of the chip's memory that tells whether it's a specific NTAGxxx chip, or the page count or the byte count?

Answer 1

In general you can only determine this by extensive fingerprinting and by probing with read commands.
Fingerprinting: This means that you would need to have a database of manufacturer-specific characteristics (e.g. collected from datasheets and -- unfortunately by far more often -- from empirical testing, as such information is not (publicly? or at all?) documented for most tags) that you can check your tag against.
Probing:
Start at page 0
Read page
On success: increment read address by 4 pages and start over
On failure: decrement read address by 1 and try to read again until you find a readable address
On sector end: start over with next sector
That way you can find the last readable page address, which is not necessarily the "real" end of the tag memory (e.g. there might be protected pages at the end).
If your Ultralight and NTAG tags are EV1 tags (i.e. they implement the Ultralight EV1 command set), the expose a GET_VERSION command which you can use to retrieve storage size information. The version information in combination with a database of all existing tag fingerprints (you can get that information from the Ultraight/NTAG datasheets) will allow you to reliably1 determine the tag type and, consequently, the memory size.
1) With the exception of some counterfeit chips sold as "NTAG" that imitate parameters of real NTAG chips but seem to have memory sizes, lack of command support, etc. that do not match the chip of which they imitate the parameters.
When it comes to NFC tags that follow the NFC Forum Type 2 tag operation specifications, you could also rely on the tag memory size that is coded into the capability container. This memory size is not necessarily the physical memory size though.

Answer 2

I think, from the accepted answer the below code make sense,
int numberOfPages = 0;
int tagType = ulTag.getType();
if(tagType == MifareUltralight.TYPE_ULTRALIGHT) {
numberOfPages = 16;
} else if(tagType == MifareUltralight.TYPE_ULTRALIGHT_C) {
numberOfPages = 47;
}
The getMaxTransceiveLength() is to retrieve the maximum amount of bytes that can be sent with transceive(byte[]).
Transceive command use first 3 bytes for Flags, Command and Page number respectively.
We need to check the below code working or not ?
int totalBytes = ulTag.getMaxTransceiveLength() + 3;
int totalPages = totalBytes / ulTag.PAGE_SIZE;

Answer 3

for MIFARE ULTRALIGHT you can check version in this way.
public static final int OFFSET_128_BYTE = 0x025;
public static final int OFFSET_48_BYTE = 0x010;
public static int checkType(MifareUltralight mrfid){
int cfgOffset = -1;
byte[] response = null;
byte[] writeResponse = null;
try {
response = mrfid.transceive(new byte[]{
(byte) 0x60 // GET_VERSION
});
} catch (TagLostException tle) {
Utility.log("setPasswordAndEnable GET_VERSION, TagLostException ... ");
return cfgOffset;
} catch (IOException ioe) {
Utility.log("setPasswordAndEnable GET_VERSION, IOException ... ");
return cfgOffset;
}
if ((response != null) && (response.length >= 8)) {
// success
if ((response[0] == (byte) 0x00) && (response[1] == (byte) 0x04)) {
// tag is from NXP
if (response[2] == (byte) 0x03) {
// MIFARE Ultralight
if ((response[4] == (byte) 0x01) && (response[5] == (byte) 0x00)) {
// MIFARE Ultralight EV1 (V0)
switch (response[6]) {
case (byte) 0x0B:
// MF0UL11
cfgOffset = OFFSET_48_BYTE;
break;
case (byte) 0x0E:
// MF0UL21
cfgOffset = OFFSET_128_BYTE;
break;
default:
// unknown
break;
}
}
}
}
}
return cfgOffset;
}