NFC Tag format

[mchangrh]

I have access to a Flipper Zero and I pulled some of the NFC tag info from the printer

The tags in the resupply roll seem to be NTAG203 while the included tag is NTAG213 (Sample size of 1)

The 213 has a signature with a Mifare version but 203 refills have neither defined. I'll do my own reverse engineering on the contents, since they are unique per roll and I'd rather avoid being traced

common data

Filetype: Flipper NFC device
Version: 4
# Device type can be ISO14443-3A, ISO14443-3B, ISO14443-4A, ISO14443-4B, ISO15693-3, FeliCa, NTAG/Ultralight, Mifare Classic, Mifare Plus, Mifare DESFire, SLIX, ST25TB, EMV
Device type: NTAG/Ultralight
# UID is common for all formats
UID: [REDACTED]
# ISO14443-3A specific data
ATQA: 00 44
SAK: 00
# NTAG/Ultralight specific data
Data format version: 2
NTAG/Ultralight type: NTAG203
Signature: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Mifare version: 00 00 00 00 00 00 00 00
Counter 0: 0
Tearing 0: 00
Counter 1: 0
Tearing 1: 00
Counter 2: 0
Tearing 2: 00
Pages total: 42
Pages read: 42
[REDACTED]
Page 8: 00 00 00 00
Page 9: 00 00 00 00
Page 10: 00 00 00 00
Page 11: 00 00 00 00
Page 12: 00 00 00 00
Page 13: 00 00 00 00
Page 14: 00 00 00 00
Page 15: 00 00 00 00
Page 16: 00 00 00 00
Page 17: 00 00 00 00
Page 18: 00 00 00 00
Page 19: 00 00 00 00
Page 20: 00 00 00 00
Page 21: 00 00 00 00
Page 22: 00 00 00 00
Page 23: 00 00 00 00
Page 24: 00 00 00 00
Page 25: 00 00 00 00
Page 26: 00 00 00 00
Page 27: 00 00 00 00
Page 28: 00 00 00 00
Page 29: 00 00 00 00
Page 30: 00 00 00 00
Page 31: 00 00 00 00
Page 32: 00 00 00 00
Page 33: 00 00 00 00
Page 34: 00 00 00 00
Page 35: 00 00 00 00
Page 36: 00 00 00 00
Page 37: 00 00 00 00
Page 38: 00 00 00 00
Page 39: 00 00 00 00
Page 40: 00 00 00 BD
Page 41: 00 00 00 FF
Failed authentication attempts: 0

[pzauner]

Do you know if they are being tracked insofar as that the printer will only allow for a certain amount of prints per known tag?

Just ordered one spool of original drm shit to put that sticker permanently inside the case of this crap

[mchangrh]

as far as I can tell, the "stopping" seems to be when it physically runs out of tags and/or there's no roll present.

[pzauner]

Perfect. My new oem roll (which shall be the last one) should have arrived; will test if it fixes the issue by just putting the sticker inside and using a non oem sticker roll

[LogON]

@mchangrh, Sorry to bother you, but could you share the full dump of this label? I have an Olympia P22 printer, and I'm having trouble making a custom tag for the ribbon. This printer uses the same NTAG203 label type. The clone of the original works fine, but I'd like to make a different type to match the ribbon, and I'd like to try your dump.

[merlinschumacher]

Hi, just to confirm/clarify details:

The NFC tag of the rolls simply contains a technical description of the inserted roll. It seems to be used to show the correct paper type in the Nelko app. This includes the physical size and resolution and other stuff like the color of the paper. It is, as far as I know, not a hard DRM measure, as the printer works fine with just a partial strip of labels without the tag or roll present (as described by @mchangrh). The official app will complain, though, as it cannot determine the type of label inserted into the printer, but allows you to set the type manually. Printing a label doesn't change the data on the NFC tag, so it doesn't seem to track the amount of printed labels off a roll. Due to the lack of different sizes/colors, it's hard to determine what the tags encode exactly. If anyone got another color roll than white or a different size (Nelko offers 14x50mm as well), send me a dump. I've got a few white 14x40mm rolls myself.

@LogON here is a complete dump of a tag of mine created by NFC Tools PRO for Android. The tag is of the same type as @mchangrh 's

[ 1D:02:D3:44 ] Sector 00 : DATA
[ C9:08:10:80 ] Sector 01 : DATA
[ 51:C0:00:00 ] Sector 02 : DATA
[ E1:10:12:00 ] Sector 03 : DATA
[ 01:03:A0:0C ] Sector 04 : DATA
[ 01:12:03:00 ] Sector 05 : DATA
[ 03:01:12:12 ] Sector 06 : DATA
[ 15:28:0F:0E ] Sector 07 : DATA
[ 00:00:00:00 ] Sector 08 : DATA
[ 00:00:00:00 ] Sector 09 : DATA
[ 00:00:00:00 ] Sector 0A : DATA
[ 00:00:00:00 ] Sector 0B : DATA
[ 00:00:00:00 ] Sector 0C : DATA
[ 00:00:00:00 ] Sector 0D : DATA
[ 00:00:00:00 ] Sector 0E : DATA
[ 00:00:00:00 ] Sector 0F : DATA
[ 00:00:00:00 ] Sector 10 : DATA
[ 00:00:00:00 ] Sector 11 : DATA
[ 00:00:00:00 ] Sector 12 : DATA
[ 00:00:00:00 ] Sector 13 : DATA
[ 00:00:00:00 ] Sector 14 : DATA
[ 00:00:00:00 ] Sector 15 : DATA
[ 00:00:00:00 ] Sector 16 : DATA
[ 00:00:00:00 ] Sector 17 : DATA
[ 00:00:00:00 ] Sector 18 : DATA
[ 00:00:00:00 ] Sector 19 : DATA
[ 00:00:00:00 ] Sector 1A : DATA
[ 00:00:00:00 ] Sector 1B : DATA
[ 00:00:00:00 ] Sector 1C : DATA
[ 00:00:00:00 ] Sector 1D : DATA
[ 00:00:00:00 ] Sector 1E : DATA
[ 00:00:00:00 ] Sector 1F : DATA
[ 00:00:00:00 ] Sector 20 : DATA
[ 00:00:00:00 ] Sector 21 : DATA
[ 00:00:00:00 ] Sector 22 : DATA
[ 00:00:00:00 ] Sector 23 : DATA
[ 00:00:00:00 ] Sector 24 : DATA
[ 00:00:00:00 ] Sector 25 : DATA
[ 00:00:00:00 ] Sector 26 : DATA
[ 00:00:00:00 ] Sector 27 : DATA
[ 00:00:00:BD ] Sector 28 : DATA
[ 00:00:00:FF ] Sector 29 : DATA
[ 00:00:00:00 ] Sector 2A : DATA
[ 00:00:00:00 ] Sector 2B : DATA
[ 00:00:00:00 ] Sector 2C : DATA
[ 00:00:00:00 ] Sector 2D : DATA

[LogON]

@merlinschumacher, Yes, that's right. My printer changes the data when printing in blocks, if I'm not mistaken, 2-4. I think it's a "mileage" counter. I played with the dump I read and discovered that the printer actually only cares about one byte of data. It's the second-to-last byte on page 7.
For me, these are bytes 0F for continuous tape. The last byte is the label width.

So, in the simplest case, a dump like this should work:

Filetype: Flipper NFC device
Version: 4
Device type: NTAG/Ultralight
UID: 00 00 00 00 00 00 00
ATQA: 00 44
SAK: 00
Data format version: 2
NTAG/Ultralight type: NTAG203
Signature: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Mifare version: 00 00 00 00 00 00 00 00
Counter 0: 0
Tearing 0: 00
Counter 1: 0
Tearing 1: 00
Counter 2: 0
Tearing 2: 00
Pages total: 42
Pages read: 42
Page 0: 00 00 00 00
Page 1: 00 00 00 00
Page 2: 00 00 00 00
Page 3: 00 00 00 00
Page 4: 00 00 00 00
Page 5: 00 00 00 00
Page 6: 00 00 00 00
Page 7: 00 00 0F 05
Page 8: 00 00 00 00
Page 9: 00 00 00 00
Page 10: 00 00 00 00
Page 11: 00 00 00 00
Page 12: 00 00 00 00
Page 13: 00 00 00 00
Page 14: 00 00 00 00
Page 15: 00 00 00 00
Page 16: 00 00 00 00
Page 17: 00 00 00 00
Page 18: 00 00 00 00
Page 19: 00 00 00 00
Page 20: 00 00 00 00
Page 21: 00 00 00 00
Page 22: 00 00 00 00
Page 23: 00 00 00 00
Page 24: 00 00 00 00
Page 25: 00 00 00 00
Page 26: 00 00 00 00
Page 27: 00 00 00 00
Page 28: 00 00 00 00
Page 29: 00 00 00 00
Page 30: 00 00 00 00
Page 31: 00 00 00 00
Page 32: 00 00 00 00
Page 33: 00 00 00 00
Page 34: 00 00 00 00
Page 35: 00 00 00 00
Page 36: 00 00 00 00
Page 37: 00 00 00 00
Page 38: 00 00 00 00
Page 39: 00 00 00 00
Page 40: 00 00 00 00
Page 41: 00 00 00 00
Failed authentication attempts: 0

That's why I want to check another dump, because I physically don't have the opportunity to purchase the original stickers for reading the dump.

[merlinschumacher]

While your printer looks very similar to the P21, it might work very different internally. You never know with products like these. It could be, that the P21 doesn't implement a counter, but the P22 does.

[LogON]

@merlinschumacher Aaaand... I tried your dump, and it worked! Thanks! Now I just need to figure out how the stickers are identified in terms of size and other things.

[merlinschumacher]

Great! ☺️

[pzauner]

So it works just putting in the sticker label from another roll. However then I thought of also getting a dump from my tag as I forgot to do before putting it in and welp, broke the label while being at it :/

As I couldn't figure out how to flash any of your dumps via NFC Tools Pro app on android: Would anyone of you guys mind sharing a small tutorial on this? I got some NTAG216 stickers laying around here

[LogON]

@pzauner Unfortunately, I don't yet know how to do this without Flipper Zero. Also, if I turn on the printer with an NTAG216 label inserted, it simply turns off when I try to connect to the app. But if I turn it on empty, connect it to the app, and then insert the labels, everything works.
If I turn on the printer with an NTAG203 label, which the Flipper emulates (original or modded), it's turning on and working without problems. Perhaps I need to look specifically for NTAG203 labels.
I'll try to post my findings here in the next few days.

Upd: I found the NTAG213 tag, and it doesn't cause any problems when turning on and connecting the printer.

[mchangrh]

Attached is my full P21 (14x40mm) tag dumps from the flipper, I didn't notice a mileage counter for my unit, attached are also 3 reads from the same strip of tape - one from the original post and two before and after consuming a label which are identical aside from a flipper header format change

Nelko.zip

[mchangrh]

As for conversion, try https://github.com/whyn0/FlipperNFC2MCT as it matches the format of #2 (comment)

[LogON]

Okay, let's see what's here. I'll be using @mchangrh's dump as a starting point.
I will update this comment as information becomes available.
@merlinschumacher @pzauner #FYI

If you have dumps of other types of stickers (for example, a real cable sticker or stickers of different colors), then please send 7 pages of data, as from the comment above.

// ===== UID and SYSTEM PAGES (Page 0-1) =====
// UID: 1D A3 16 8F 09 10 80
Page 0: 1D A3 16 20  // UID bytes 0-3 + BCC0 (check byte for UID0-2)
Page 1: 8F 09 10 80  // UID bytes 4-7 + BCC1 (check byte for UID3-6)
// NOTE: UID is not validated by the printer for tape parameters.

// ===== NDEF CAPABILITY CONTAINER (Page 2) =====
// Defines NDEF message structure. Must match the actual data layout.
Page 2: 16 C0 00 00  // [0x16] NDEF CC: depends on tape type? Seems to be non critical
                     // [0xC0] Magic Number (0xE1 with modified flags?)
                     // [0x00 0x00] Reserved/Access flags

// ===== NDEF RECORD HEADER (Page 3) =====
// Custom NDEF header?
Page 3: E1 10 12 00  // [0xE1] Flags: MB=1,ME=1,CF=0,SR=1,TNF=1 (Well-Known)
                     // [0x10] Total NDEF record length: 16 bytes
                     // [0x12] Start of payload data
                     // [0x00] ID Length (unused)

// ===== MANUFACTURER CONSTANT (Page 4) =====
// Specific signature. Seems to be constant across all dumps.
Page 4: 01 03 A0 0C  

// ===== PRIMARY TAPE TYPE SELECTOR (Page 5) =====
// Main tape category selector. Determines how Page 6-7 are interpreted.
Page 5: 01 12 03 00  // [0x01] Constant prefix
                     // [0x12] PRIMARY TYPE: 0x12=Labels, 0x22=Continuous, 0x3A/0x31/0x20=Cable
                     // [0x03] Color code, examples:
                                  //0x02 -> White
                                  //0x04 -> Pink
                                  //0x06 -> Yellow
                                  //0x0A -> Turquoise
                                  //0x0C -> Light Purple
                                  //0x14 -> Organic Green
                                  //0x18 -> Glicine
                                  //0x19 -> Light Blue
                                  //0x11 -> Pastel White

                     // [0x00] Constant ?

// ===== TAPE SUB-TYPE & PARAMETERS (Page 6) =====
// Detailed parameters. Interpretation depends on Page5 byte 1.
Page 6: 03 01 12 12  // [0x03] Constant prefix
                     // [0x01] SUB-TYPE FLAG: 0x00=Disables labels (for continuous),
                     //                       0x01=Standard labels,
                     //                       0x51=Cable labels, etc
                     // [0x12] MATERIAL TYPE: 0x01=White paper,
                     //                      0x02=Black paper,
                     //                      0x03=Tattoo paper,
                     //                      0x04=Sheet,
                     //                      0x05=Foldable,
                     //                      0x06=Perforated,
                     // [0x12] LENGTH/GAP CODE: Works with Page7 byte1 to determine gap size
                     //                       For 40mm/5mm labels = 0x12

// ===== PHYSICAL DIMENSIONS (Page 7) =====
// Physical tape dimensions. Interpretation depends on tape type.
Page 7: 15 28 0F 0E  // [0x15] Constant?
                     // [0x28] LABEL LENGTH in mm (HEX): 0x28=40mm
                     //        For cable labels: defines total cycle length when combined with Page5
                     // [0x0F] Constant (may be sensor calibration). CRITICAL!
                     // [0x0E] For regular labels: TAPE WIDTH in mm (HEX): 0x0E=14mm

// ===== WORKING COMBINATIONS (Validated) =====
// Continuous tape:  Page5=0x22, Page6=03 00 00 00
// Regular 40mm labels: Page5=0x12, Page6=03 01 01 12, Page7=15 28 0F 0E
// ===== NEED TESTING =====
// Cable labels (40mm cycle): Page5=0x28, Page6=03 51 13 12, Page7=15 28 0F HH (HH=height)
// Cable labels (58mm cycle): Page5=0x3A, Page6=03 51 13 12, Page7=15 28 0F HH

[LogON]

Here is NFC tag dump of my OLYMPIA 6312 label roll (Label roll, 14 mm x 7.5 m, continuous)

Page 0: 1D 78 C4 29
Page 1: 91 09 10 80
Page 2: 08 C0 00 00
Page 3: E1 10 12 00
Page 4: 01 03 A0 0C
Page 5: 01 22 03 00
Page 6: 03 00 00 12
Page 7: 15 0A 0F 0E