Detecting NFC Tag removal hacking [Powerd with Xposed, Broadcast Intent to Tasker]

madfish73

Senior Member
Oct 29, 2011
121
97
0
[2014-03-13] back to Nfc.apk mod again( since xposed won't work under KitKat ART mode)
http://forum.xda-developers.com/showpost.php?p=51047371&postcount=404


No more hacking, no more mod(nfc mod, still need AnyTag mod), with Xposed(you can download XposedInstaller.apk in that thread), you just need to install a plugin :
[2014-02-10, compatiable with AOKP kitkat 4.4.2]
(I've modified this plugin to support tag removal detecting, so you don't need nfc.apk mod any more)
[2013-10-25 updated, Add Intent broadcast to support "Tasker Intent receiver", pk.qwerty12.nfclockscreenoffenabler.TAG_EVENT, Extras: state=discovered/lost, uid=XXXXXXXX(HEX of tag id), Tasker variables: %state, %uid]
[2013-10-24 updated, Add Intent broadcast to support "Tasker Intent receiver", pk.qwerty12.nfclockscreenoffenabler.TAG_DISCOVERED_XXXX, pk.qwerty12.nfclockscreenoffenabler.TAG_LOST_XXXX(where XXXX is the HEX of specified tag id). Don't need AnyTag anymore, with tasker you can receive Intent when tag discovered or tag lost]
[2013-10-22 updated, Add support for LG G2 (D802 - internationnal version), merged with MohammadAG's code]
[2013-10-09 updated, NOW ALSO compatible with android 4.1 and before. The Apk version is still v1.4 ]
[2013-09-20 updated, add tag presence check timeout setting, this can help for battery saving.]
[2013-09-05 updated, modified by MohammadAG, added taglost sound option]

View attachment NFCLockScreenOffEnabler19.apk
View attachment NFCLockScreenOffEnabler1.9-src.zip

the testing for battery consumption effected by tag presence check timeout setting(GalaxyNexus JB4.3 stock ROM)
timeout stock setting: 125ms
wifi off, put phone on tag all night
begin time: 01:36 battery: 97%
end time : 10:26 battery: 34%
battery consumption per hour: 7.134%

timeout custom setting: 20 seconds
wifi off, put phone on tag all night
begin time: 23:27 battery: 98%
end time : 08:03 battery: 56%
battery consumption per hour: 4.884%

timeout custom setting: 4 seconds
wifi off, put phone on tag all night
begin time: 00:11 battery: 97%
end time : 08:12 battery: 54%
battery consumption per hour: 5.364%


Battery consumption without nfc tag(Galaxy Nexus JB4.3 Stock ROM)
reboot, wifi off, Disable Nfc
begin time 23:56 battery: 98%
end time 07:30 battery: 90%
battery consumption per hour: 1.056%

reboot, wifi off, Nfc on, Disable nfc when screen off
begin time 23:03 battery: 96%
end time 07:30 battery: 86%
battery consumption per hour: 1.182%

reboot, wifi off, Nfc on, Enable nfc when screen off
begin time 23:10 battery: 100%
end time 07:30 battery: 86%
battery consumption per hour: 1.68%



Thanks to rovo89 for his great work - Xposed!
and thanks to Neuer_User for his suggestion.
The code of the plugin module NFCLockscreenoffEnabler.apk is based on the Xposed mod of NFC lock screen: https://github.com/qwerty12/NFCLockscreenoffEnabler/, thanks to the author of it.

1. install Xposed
2. install NFCLockScreenOffEnabler
3. Checked NFCLockScreenOffEnabler in Xposed
4. set options you want.
5. reboot
5. still need AnyTag mod version, or you can install new version of ReTag, it supports tag lost message now!!


What this mod can do?

after did this mod, with AnyTag(mod) + tasker + secure settings plugin + secure settings helper, you can:
1. put your phone on the "Bedside tag", your phone turn to silence mod, take the phone off the tag, your phone auto turn off silence mod
2. put your phone on the "CarDock tag", your phone auto unlock, turn to CarHome mode, run some special apps, take the phone off the tag, your phone auto kill some special apps, exit carhome mode, lock screen ...
3. Other things you can image....

How to receive tag discovered Intent with Tasker?
Tasker->profiles->add->Event->System->Intent Received->Action=pk.qwerty12.nfclockscreenoffenabler.TAG_DISCOVERED_XXXXXXXX
where XXXXXXXX = HEX string of your tag id, like: 00AABBCC

How to receive tag lost Intent with Tasker?
Tasker->profiles->add->Event->System->Intent Received->Action=pk.qwerty12.nfclockscreenoffenabler.TAG_LOST_XXXXXXXX
where XXXXXXXX = HEX string of your tag id, like: 00AABBCC

How to use tasker to auto unlock your phone and run some apps?

tasker + secure settings plugin + secure settings helper
Create task, add actions:
1. Secure Settings, Screen & Keyboard Lights On 5 seconds
2. Wait 60ms
3. Secure Settins, Keyguard Enabled
4. Wait 100ms
5. Secure Settings, Keyguard Disabled/BG
6. run apps ....
7. do things you want ...
8. Secure Settings, Screen & Keyboard Light On 10 Seconds
...
..

How to do that
1. Download the mod AnyTag.apk from attachments. Install it.
2. Download the mod Nfc.apk (device dependence) from attachments, copy it to /system/app/Nfc.apk, reboot


download modified anytag.apk: View attachment AnyTAG1.2.6-mod.apk


=====================obsolete =============================

#download modified Nfc.apk:
#AOKP ROMs
#Galaxy Nexus 4.1.2 AOKP: View attachment 1700757
#Galaxy Nexus 4.2.1 AOKP: View attachment 1767293
#Galaxy Nexus 4.2.2 AOKP: View attachment Nfc4.2.2-mod.apk
#
#InsertCoin
#HOX InsertCoinV17 4.1.1(not test): View attachment Nfc-HOX-InsertCoinV17-4.1.1.apk
#
#Stock ROMs
#Galaxy Nexus 4.2.1 (thanks for LoveNFC): View attachment Nfc-mod-combine-GN4.2.1.apk
#Galaxy Nexus 4.2.1 Tag lost with no sound: View attachment 1781195
#Galaxy Nexus 4.2.2 : View attachment Nfc-GN-stock422-combine-mod.apk
#Google Nexus4 4.2.2 (thanks for LoveNFC): View attachment NfcNci-mod-combine-N4-4.2.2.apk
#Google Nexus4 4.2.2 Tag lost with no sound: View attachment 1781196
#Galaxy Note2 N719 4.1.1 : View attachment Nfc-Note2-4.1.1(N719).apk
#Galaxy Note2 N7100 4.1.2 : View attachment 1783180
#Galaxy Note2 Sprint 4.1.2 : View attachment Nfc-Sprint-note2-4.1.2-mod.apk
#Galaxy Note2 LTE(N7105 XXDMB2) 4.1.2 : View attachment Nfc-Note2LTE-N7105XXDMB2-4.1.2-mod.apk
#Galaxy S3 i747 4.1.1 (thanks for klau1): View attachment Nfc-mod-combine.apk
#Galaxy S3 4.1.2 (tested by fruitloopy) : View attachment Nfc-GS3-4.1.2-mod.apk
#
#Others
#4.1.2-N7100UBDMB1-CRISKELO-v14--->same as----
#---->AmnoSferum_9.0.1_Mescaline_XXDMD2: View attachment Nfc-N7100UBDMB1-CRISKELO-v14-mod.apk
#Nexus4 PurityV5.5: View attachment NfcNci-mod-ScreenOn-Signed.apk
#
#3. Download tasker, Secure settings plugin for tasker, Secure Settings Helper
#
#Video demo
#

#

"Bedside Tag": http://youtu.be/_c9Lo-jwErg
galaxy note2(china telecom N719): http://youtu.be/UlbxGoGjysI
TouchStone& "Carmode Tag": http://youtu.be/zeJZ_Cy7_mM
ES Ftp Tag with PC react: http://www.youtube.com/watch?v=_1oN2vmHwtY

Mod Details:

1. mod nfc.apk(mod android source code and rebuild), when tag lost, broadcast intent with action "android.nfc.action.TAG_LOST"



2. mod AnyTag NFC Launcher apk, play a trick with TagId, when intent action is "TAG_LOST", Tagid=Tagid + "_TAG_LOST", otherwise, Tagid = Tagid + "_TAG_DISCOVERED"


=====================obsolete =============================
apk mod --------------------Step by Step(Note2, Windows)---------------------------------

1. tools needed
baksmali and smali
apktool (1.5.1)
WinRAR
2. copy /system/framework from phone to PC folder like D:\qlg\Dev\android\note2(N719)\framework\
3. copy /system/app/Nfc.apk, Nfc.odex to d:\temp\mod\
4. cmd box, cd d:\temp\mod\
5. java -jar D:\tools\android\baksmali1.4.1\baksmali-1.4.1.jar -d D:\qlg\Dev\android\note2(N719)\framework -x -b Nfc.odex
this will decompile Nfc.odex to d:\temp\mod\out\
6. d:\tools\android\apktool\apktool1.5.1\apktool.bat d -f --frame-path D:\qlg\Dev\android\note2(N719)\framework Nfc.apk
this will decompile Nfc.apk to d:\temp\mod\Nfc\
7. copy taglost.ogg to d:\temp\mod\Nfc\res\raw\
8. edit d:\temp\mod\Nfc\res\values\public.xml add
<public type="raw" name="taglost" id="0x7f040006" />
9. cd d:\tools\android\apktool\apktool1.5.1\
apktool.bat b d:\temp\mod\Nfc\ d:\temp\mod\Nfc-mod.apk
10. modify smali files in path d:\temp\mod\out\
files need to modify:
NativeNfcManager.smali
NativeNfcTag$PresenceCheckWatchdog.smali
NativeNfcTag.smali
DeviceHost$DeviceHostListener.smali
DeviceHost$TagEndpoint.smali
DeviceHost.smali
NfcDispatcher$DispatchInfo.smali
NfcDispatcher.smali
NfcService$NfcServiceHandler.smali
NfcService.smali
R$raw.smali

you can use BeyondCompare to help you do the modification.
This is the original smali files and modified smali files of N7100 v4.1.2, compare it with your Nfc smali files, and you will know which place need to modify.
View attachment note2(N7100)-smali.rar
be aware with lines contain something like "access$xxxx", make sure the number xxx matching your actual number.

11. cd d:\temp\mod
12. java -jar D:\tools\android\baksmali1.4.1\smali-1.4.1.jar -o classes.dex out
this will compile smali files in d:\temp\mod\out , and generate d:\temp\mod\classes.dex
13. rename stock apk, d:\temp\mod\Nfc.apk--> Nfc.apk.zip,open it with WinRAR,
rename d:\temp\mod\Nfc-mod.apk -->Nfc-mod.apk.zip,open it with WinRAR
14. drag resources.arsc and res\raw\taglost.ogg from Nfc-mod.apk.zip into Nfc.apk.zip, drag d:\temp\mod\classes.dex into Nfc.apk.zip, when WinRAR popup the options window, choose the compression mode as Store
15、rename Nfc.apk.zip to Nfc.apk, copy it to your phone /system/app, delete /system/app/Nfc.odex, change Nfc.apk permission rw-r--r--
16、reboot


OK, as Orphee said, we should not abandon old things, maybe they would be useful when it's the time you need them.
Here, I've found another way to mod nfc.apk, we touch less files this time - only 4 files:
NativeNfcTag$PresenceCheckWatchdog.smali
NativeNfcTag.smali
DeviceHost$TagEndpoint.smali
NfcService$NfcServiceHandler.smali
Details : View attachment Nfc-taglost-mod-doc.rar
 
Last edited:

ascsa

Senior Member
Oct 25, 2011
955
561
0
I've mod NFC.APK source code of AOKP, and successfully let's NFC ReTag perform the second cycle activity when the tag removed away. Now, my phone can auto turn to silent ringer mode when put on the Bedside tag, and auto turn to normal ringer mode when take away from the tag.
....
Impressive work!

Could not test it by myself so far, because I´m a little bit busy with other stuff , but had a look at your code, and I think it should work pretty good for your use case!

Not sure if it will work for everyone, because if I got it right, the dispatchTagEndpoint part will start a new dispatching process, and therefore a normal swipe/ tap of the tag (I think most people will swipe their tags) will give you 2 dispatching events ....--> some people/ apps will get confused ... .... However with NFC Retag you could add for example an empty cycle to catch this second event and handle this way your "swipe" tags and your "stationary" tags ...

I´m also not sure, If the broadcom nfc stack will handle this similar ...I only had a quick look at the nxp.NativeNfcManager ....but again: Impressive work!

EDIT: OK, several month later ....it´s implemented within NFC ReTag version 2.6.....;)
 
Last edited:

madfish73

Senior Member
Oct 29, 2011
121
97
0
Impressive work!

Could not test it by myself so far, because I´m a little bit busy with other stuff , but had a look at your code, and I think it should work pretty good for your use case!

....

It will be nice if you add support of action "android.nfc.action.TAG_LOST" to ReTAG, and I'll try to mod NFC.apk to broadcast that action when tag removed.
 

ascsa

Senior Member
Oct 25, 2011
955
561
0
It will be nice if you add support of action "android.nfc.action.TAG_LOST" to ReTAG, and I'll try to mod NFC.apk to broadcast that action when tag removed.
yep, had a similar idea ... not sure if I could add it within the next update and I have to think about it, how to handle it (e.g. via a special cycle), but this should be possible.
 

madfish73

Senior Member
Oct 29, 2011
121
97
0
yep, had a similar idea ... not sure if I could add it within the next update and I have to think about it, how to handle it (e.g. via a special cycle), but this should be possible.
I've done this and it worked perfectly with modded "AnyTag NFC" apk.
I play a trick with tagid, if intent action is "TAG_LOST" then let tagid = tagid + "_TAG_LOST" else tagid = tagid + "_TAG_DISCOVERED".
 

klau1

Senior Member
Jan 1, 2008
1,793
389
103
Please try this one:

NFC.APK from ROM: [root66_BMC_I747MVLDLK4]

Thank you! You are very helpful!

EDIT:
edited to add the odex file
 

Attachments

Last edited:

madfish73

Senior Member
Oct 29, 2011
121
97
0
Sorry about that.

Here it is: Attached with this post.
Sorry, still missing some files.

I've tried to use files of Note2 framework, there's no framework_ext.odex in Note2 framework files list.
I really don't know what files needing, so I have to try it one by one. Please upload the following file:

/system/framework/framework_ext.odex
 

klau1

Senior Member
Jan 1, 2008
1,793
389
103
Sorry, still missing some files.

I've tried to use files of Note2 framework, there's no framework_ext.odex in Note2 framework files list.
I really don't know what files needing, so I have to try it one by one. Please upload the following file:

/system/framework/framework_ext.odex
No worries, I appreciate your effort :good:

Here is the framework and NFC files: Attached with this Post

Here is the rooted Rom: root66_BMC_I747MVLDLK4.7z

There are also:
framework2.jar
framework2.odex
framework-res.apk

^those were not included with in the ZIP file. Let me know if you need them too.
 
Last edited:

madfish73

Senior Member
Oct 29, 2011
121
97
0
No worries, I appreciate your effort :good:

Here is the framework and NFC files: Attached with this Post

Here is the rooted Rom: root66_BMC_I747MVLDLK4.7z

There are also:
framework2.jar
framework2.odex
framework-res.apk

^those were not included with in the ZIP file. Let me know if you need them too.
try it and tell me the result:

1. download attachment, rename it to Nfc.apk
2. bakcup your files: /system/app/Nfc.apk, Nfc.odex
3. delete /system/app/Nfc.odex
4. Copy attatchment file(named it Nfc.apk) to /system/app
5. reboot

View attachment Nfc-mod-combine.apk
 
  • Like
Reactions: klau1

klau1

Senior Member
Jan 1, 2008
1,793
389
103
Re: Detecting NFC Tag removal hacking [add video demo & apk !!!]

The result is great! It works very well. I downloaded your modded anynfc too.

Do you have a paypal account to donate to? Not much to give but maybe enough for a beer:D

Sent from my SGH-I747M using Tapatalk 2
 

klau1

Senior Member
Jan 1, 2008
1,793
389
103
Re: Detecting NFC Tag removal hacking [add video demo & apk !!!]

There is only one problem.

The NFC doesn't function on screen off or lock screen.

For reference, This one (attached) from LK3 rom has the modded code for working in Screen Off and Lock Screen. Perhaps it will work if the code can be copied over to the LK4 NFC.APK you modded?
 

Attachments

Last edited:

madfish73

Senior Member
Oct 29, 2011
121
97
0
There is only one problem.

The NFC doesn't function on screen off or lock screen.

For reference, This one (attached) from LK3 rom has the modded code for working in Screen Off and Lock Screen. Perhaps it will work if the code can be copied over to the LK4 NFC.APK you modded?
Well, I missed a constant value in the code, this one maybe ok, try it again:
View attachment Nfc-mod-combine.apk
 
  • Like
Reactions: klau1

klau1

Senior Member
Jan 1, 2008
1,793
389
103
Re: Detecting NFC Tag removal hacking [add video demo & apk !!!]

Yep it works! Awesome!:thumbup: let me know about that PayPal donation email anytime:D :beer:

I hope there is a way to universalize this so many phones can work.

Perhaps something like Xposed Framework can work. It modifies method calls of APKs at runtime.
http://forum.xda-developers.com/showthread.php?t=1574401

Sent from my SGH-I747M using Tapatalk 2
 
Last edited:

klau1

Senior Member
Jan 1, 2008
1,793
389
103
Re: Detecting NFC Tag removal hacking [add video demo & apk !!!]

Read the previous post about framework files I sent

Sent from my SGH-I747M using Tapatalk 2
 

LoveNFC

Senior Member
May 14, 2012
161
63
0
There's no framework-ext file in the Nexus devices, so I've attached Framework.odex and its related files, as well as ext.odex and its related files.

The Nexus 4 unsurprisingly is a bit different. It has NFCNci.apk/.odex instead of just NFC.apk.

Hopefully the modification will still be possible, but I won't be surprised if it's not.

By the way, these files are taken from a stock Galaxy Nexus on 4.2.1, and a stock Nexus 4 on 4.2.2.

The files wouldn't attach, so here they are:

http://speedy.sh/dwPu9/Galaxy-Nexus-NFC.zip

http://speedy.sh/E46QA/Nexus-4-NFC.zip

Thanks!