The Making Of Hex NFC: The ultimate NFC tool app

About 4 months ago during a weekend trip to Melbourne, the idea for Hex Pro's first app slammed into me like a truck with a drunk driver at the wheel. And that comparison is apt because that's exactly the vibe I got 2 months into the project.

A few days before, I was helping my local gym set up a payment solution for their mini-fridge (which I so kindly donated 3 days after purchasing from Bunnings for $1000 and realising it was way too loud to sit in my bedroom). The young hustler looking to make a few extra bucks by selling energy drinks was planning to have people PayID payments to him. As a self-respecting software engineer, I couldn't allow him to take such a sloppy approach. So I volunteered to implement an NFC payment solution for free.

I'd actually never worked with NFC tags at the time, but I did my research and then jumped on AliExpress and ordered up a 10 pack of NTAG213s. Then I threw together a quick payment portal using Stripe. When I went to program the new NFC tags with the URL for the portal, I came across something interesting. The biggest NFC app on the iOS App Store had 14,000 reviews, so hundreds of thousands of installs, if not millions. So I naturally installed it and gave it a run. What did I find? The app was total shit of poor quality. I couldn't believe that this was the top dog. Could we really do no better than this? Honestly, no shade to its developer. In hindsight, I now understand the challenges that they must've faced in developing their app. But safe to say that it was the catalyst for Hex NFC.

For the uninitiated, what actually is NFC? It stands for Near Field Communication, a 'highly technical' term for, "put device close to tag to scan."

NFC chips are actually tiny computers, real silicon microchips that can perform logical operations and store data. Most are too simple for the former, but some can perform actions like encryption and perform mathematical operations on random numbers (challenge responses). The coolest thing about NFC chips is that they don't have their own power source. Instead, your reader device (in this case, an iPhone) projects an electromagnetic field that powers the NFC chip. Truly genius technology, and it gets better. The chip then oscillates a magnetic rhythm in response that the reader detects and converts to readable bits.

The tricky part here is that there are a variety of different NFC chip models and manufacturers, each with their own protocols and architecture, and not all of their datasheets are particularly transparent.

The first thing I did after returning from Melbourne to the Sunshine Coast, was to start building virtual emulators for different NFC chips. At the time, I didn't have access to many NFC tags. My inventory getting started was 5 NTAG213s from the gym expedition, and two mysterious public transport cards (a Japanese Pasmo and a Myki from Melbourne), which the iPhone was able to scan, but gave no obvious hints about.

I figured that, if the documentation for the NFC chips was solid enough online, I could avoid needing to have actual physical NFC chips of every kind. I would just run my logic through emulators and know it works from there. How naive I was back then.

The NTAG213 actually went fairly smoothly. It's the most popular type of consumer-grade NFC chip and well documented. A battle-tested device used globally and strongly compliant with open standards.

When I started to work on those two mysterious transit cards I realised things weren't going to be as simple as I thought. The Pasmo card turned out to be of Sony-make, a FeliCa smart card used across all of Japan's public transport systems, with capabilities that exceed practically all other chips of similar type. The Myki was a read-only MIFARE DESFire EV3, of NXP-make, the same manufacturer as the NTAG213.

The goal was to create the ultimate NFC tool, something that really blew the others out of the water. As the capability requirements expanded, and I learned more about the number and variety of chips actually available, I knew I couldn't avoid real-world testing. So I ordered a wide variety of chips to try and maximise my coverage. You can see the full list here.

And so the emulator development began in earnest. Every chip got its own, and I meticulously tested every operation and capability on real-world silicon to ensure that the emulators matched the real chips as closely as possible. Not an easy feat, and extremely time-consuming, but 100% worth the trouble. I spent hundreds of hours to gain impressive reliability and the ability to unit test against each model of real silicon.

One of the major hurdles in this project is that I desired to develop this package without any reliance on external libraries or dependencies (with the exception of Apple). The whole vibe for Hex Pro is privacy, trust and integrity. They're a set of ethics that were drilled into me as a child, and I really think that doing things right will lead to greater success than doing what's expedient. Throughout my professional career, I've always done my utmost to maintain client trust, and the implicit trust granted to me in my roles has always led to more efficient and productive working relationships. So for my future customers, it's a priority to extend that same respect to them as well.

As such, I avoided third-party packages completely, which results in a much cleaner, fully natively developed app in the end. Nobody is slipping anything into this one that I don't know about. That being said, I had to develop my own implementations of the following code:

• PACE big-number maths and elliptic-curve cryptography (Brainpool curves).

• Chip drivers & NDEF Handling.

• Transit History Readers (for FeliCa chips)

• Japanese Public Transport Station Name Library

One of the unique features of Hex NFC is its ability to read ePassport data. It's a particularly fascinating and underutilised capability of iOS devices. I first learned of its existence while authenticating with a government-run ID app a year ago. Safe to say that I was completely enchanted by the possibilities of simply tapping your ID to prove your identity. Since I knew it was possible, I knew I had to have it.

My only concern was that it might be restricted to apps from government organisations. I need not have worried, because it turns out that ePassport chips are well-documented and surprisingly easy to work with... That would be the case if Apple natively offered support for the encryption algorithms PACE uses. No such luck, and with my "no third-party packages" constraint, it meant I had to develop my own Brainpool implementation. An extremely time-consuming task that was 100% worth the trouble. The resulting passport scanning capabilities are fascinating, and I had the privilege of testing it out on both an Australian passport, and conveniently, a Nepalese passport. It's a feature I really recommend people try out on their own, you'd be fascinated by what information is kept in the accessible partition of your passport's chip (unless you're American, in which case it's practically nothing).

The other big one for me was Japanese transit cards. A capability I knew was possible, but had never seen in an NFC reader before. These cards are fascinating. They have the capability to hold all sorts of information. They keep track of your card's balance, keep a history of when and where you tap on and off public transport, and even record when you spend money at convenience stores or vending machines.

The big challenge is that the Japanese government isn't exactly helpful when it comes to mapping station IDs to actual names. Now, if I was a scumbag, I could just steal the data from licensed online hobbyist collections. But we're doing things properly here, so I decided to develop our own database from scratch. I went ahead and figured out the station names on my own Pasmo, then asked around the neighbourhood and got my hands on a Suica. Both provided information about where I and the neighbour had travelled. From there, I began to work on the database. Unfortunately, the collection for both of us as tourists was small. I compromised on my 'no network requests' rule here, and included a 'submit your own' function for those that would like to contribute their own information about station names. Over time, I hope we'll build up a legitimate open source table mapping the data, that can compete with the hobbyists who (fairly) license against others using their work.

Hex NFC makes a major effort to try and support every chip Apple lets you scan. I wasn't able to get my hands on every single type of chip in hard silicon, but I got enough coverage that I was able to extrapolate the missing chip architecture from data sheets and similar models. For example, I never was able to get an NTAG215, but it's a similar enough architecture to NTAG213 and NTAG216 that I was able to build an emulator that should cover it fully.

The chips I have fully tested on silicon follow.

• NTAG 210µ
• NTAG213
• NTAG216
• NTAG424 DNA
• Ultralight EV1 128b
• Ultralight C
• ICODE SLIX
• ICODE SLIX2
• DESFire EV3
• FeliCa (Suica & Pasmo)

I also know the MIFARE Classic does work, Apple simply doesn't scan it.

You can imagine though, with read, write, encryption, permanent locking, limited password attempts, erasing/dumping data blocks, and more, there was a huge amount of bench testing required. You'd be amazed at how many tiny intricacies the datasheets missed and the emulators needed updating. I'm actually quite sure at this point that the Hex NFC emulators are the best mappings of the real world silicon on the internet.

Along with each of those, I built in every type of useful record that I could think of. These include the following:

Text, URL links, Android/iOS app links, Wi-Fi credentials, contacts, mail, phone, SMS, FaceTime, maps, Bluetooth handover, crypto addresses, Shortcuts, templated data and raw bytes, plus social profiles across 22 platforms and search across seven engines.

If anyone has recommendations or requests for further support, [email protected] is open.

What we ended up with is what I'm certain is the most capable and well-designed NFC app on iOS. It provides professional-grade tools including support for mass tag writing, superior information and data display, saving data templates/presets, and an advanced command console for the power users out there. It's reliable, handles bad taps well, and can be used to format factory chips, and repair broken ones in some scenarios.

So if it's so good, why aren't I selling it instead? I spent hundreds of hours working on it, where people typically have paid me ~$100/hour for my work in the past. Theoretically over $30,000 invested in this if you count that. Shouldn't I recoup my costs? You may have even noticed that it's licensed under BSL 1.1 (Business Source License), which is source available, and will convert to open source automatically after a few years.

Well I have grander plans. Hex Pro is a startup right now, which means that I don't have an established reputation or userbase. My hope is that Hex NFC blows up and becomes a popular tool, a real competitor to the most popular NFC apps. I will never splash third-party ads onto any of my apps. I just won't do it on principle. But when I release other projects, I'd like to put a cross-promo banner at the bottom of the home page. Nothing invasive, but enough to put my other work in front of people who appreciate the quality of Hex NFC and are interested in other high quality apps.

So my primary goal, aside from providing a sorely needed piece of software to the world, is to build Hex Pro's reputation, and cross promote to apps that do make money.

---

I hope that users will support this endeavour, and I look forward to seeing people enjoying Hex NFC.

For your consideration, I present Hex NFC.