Overview

The HydraNFC V2 Sniffer Decoder is an open source specialized protocol decoder for ISO14443A / MifareClassic NFC communications.
It works with DSView & Sigrok/PulseView and is designed specifically for the HydraNFC Shield_V2 hardware.
See GitHub repository https://github.com/hydrabus/hydranfc_v2_sniffer_decoder
See also GitHub Wiki https://github.com/hydrabus/hydranfc_v2_sniffer_decoder/wiki#hydranfc-v2-sniffer-decoder

HydraNFC v2: Real-Time NFC Sniffing & Cracking Powerhouse Video by Penthertz

System Requirements

Hardware

• HydraBus v1 + HydraNFC Shield v2 hardware
• Compatible Logic Analyzer
  • DSLogic or Sigrok / PulseView-compatible hardware
  • Minimum 10MHz sampling rate ( >25MHz recommended)
  • Memory capacity for extended captures (we can captures hours of communication depending on RAM available in the computer and feature like RLE)

Software Compatibility

• PulseView v0.5 (libsigrokdecode v0.6 / Python 3.4)
• DSView v1.3.2 (libsigrokdecode4DSL 0.6.0 / Python 3.6)

Hardware Setup

Logic Analyzer Connections

• GND → HydraNFC v2 GND
• Channel 0 → HydraNFC v2 ST25R3916 CSO pin (Digital Demodulation output)
• Optional Channel 1 → HydraNFC v2 ST25R3916 CLK/PA5 (configured at 3.39MHz based on HydraNFC v2 NFC clock 27.12MHz)

Analyzer Configuration

• Capture trigger on Channel 0 (CSO) with rising edge
• Sampling rate: ≥10MHz (>25MHz recommended)
• Configurable pre/post-trigger buffers

Firmware Usage

• Uses HydraBus HydraNFC v2 firmware
• Commands:
  • dnfc
  • sniff
• System will display:
  • T_SNIFF (Test special sniffer ST25R3916 MCU_CLK(PA5) and CSI CSO)

Technical Capabilities

Protocol Support

• ISO14443A / Mifare communications
• ST25R3916 analog frontend and digital demodulator processing
• ISO14443A 106 kbps baudrate
• All UID sizes (4, 7, 10 bytes)
• Complete command and response handling

Supported Commands & Responses

ISO14443A Protocol Support

• REQA (0x26) → ATQA response
• WUPA (0x52) → ATQA response
• ANTICOL CL1 (0x93, 0x20) → UID CL1 response
• SELECT CL1 (0x93, 0x70) → SAK CL1 response
• ANTICOL CL2 (0x95, 0x20) → UID CL2 response
• SELECT CL2 (0x95, 0x70) → SAK CL2 response
• ANTICOL CL3 (0x97, 0x20) → UID CL3 response
• SELECT CL3 (0x97, 0x70) → SAK CL3 response
• HALT (0x50) → No response
• RATS (0xE0) → ATS response
• PPS (0xD0) → PPS response

MIFARE Classic Commands

• MC-AUTH-A (0x60) → Encrypted response
• MC-AUTH-B (0x61) → Encrypted response
• MC-WRITE (0xA0) → Encrypted response

MIFARE Ultralight/NTAG Commands

• READ (0x30) → 16-byte page data
• READ-CNT (0x39) → Counter value
• PWD-AUTH (0x1B) → Authentication response
• FAST-READ (0x3A) → Multiple page data
• READ-SIG (0x3C) → Signature data
• WRITE (0xA2) → ACK/NAK response

Additional Features

Advanced Protocol Analysis

• Decoding of both Reader and Tag communications
• Automatic timeout detection and reporting
• Adaptive sampling rate handling
• Dynamic edge detection and validation

Validation mechanisms

• ISO14443A CRC16 for commands and responses
• BCC for UID and SELECT commands
• Encrypted Mifare Classic communication detection

Tag Type Detection

• MIFARE Classic (1K/2K/4K)
• MIFARE Mini
• MIFARE Plus (2K/4K)
• MIFARE DESFire
• MIFARE UltraLight
• NTAG (including NTAG424DNA)
• Infineon MIFARE Classic
• Nokia MIFARE Classi
• Gemplus MPCOS
• Innovision RT Jewel
• Others

Security Features

• Automatic detection of encrypted communications
• Cryptography state tracking
• Secure command handling for authenticated sessions

Output Information

Data Processing

• Reader Bits: Complete raw bits stream
• Reader Data: Complete raw byte stream (including BCC/CRC)
• Reader Command: Filtered command bytes (excluding BCC/CRC) with validation status
• Tag Bits: Complete raw bits stream
• Tag Data: Complete raw byte stream (including BCC/CRC)
• Tag Answer: Filtered response bytes (excluding BCC/CRC) with validation status

Validation Indicators

• BCC&CRC OK/ERR: Combined validation for SELECT commands
• CRC OK/ERR: Individual CRC16 validation for commands/responses
• BCC OK/ERR: Individual BCC validation for UID responses

Debug Capabilities

Analysis Tools

• Protocol state tracking
• Cascade level monitoring
• Encryption state detection
• Timing analysis
• Error reporting

Display Features

• Error highlighting
• Multi-layer protocol view
• Hierarchical data presentation
• Timing measurements

DSView / sigrok PulseView captures

Support

For additional information or custom requirements, contact us through: HydraBus Contact Form
You can also create an issue on GitHub (Contributions are welcome): https://github.com/hydrabus/hydranfc_v2_sniffer_decoder/issues

Last updated: March 27, 2025