inspect-tag

Inspect Tag

Deep inspection of an NFC tag's hardware properties, memory layout, lock state, and capacity. Useful for diagnosing why writes fail or whether a tag is locked/read-only.

When to use

• A write operation failed and you need to understand why (tag locked, memory error, wrong tag type).
• You need to confirm a tag's type and capacity before a write operation.
• Checking lock byte / CC byte status before applying password protection.
• Verifying whether a tag is blank or pre-programmed.

Inputs to gather

• None required — user simply presents the tag to the reader.

Procedure

1. Verify nfc-list is available.
2. Prompt user to present the tag.
3. Run nfc-list to detect the tag. Capture UID and initial type classification. Fail if no tag is detected.
4. Identify tag type and run appropriate inspection:
   • NTAG21x (213, 215, 216): Run nfc-mfultralight info or equivalent to read:
     • UID (7 bytes).
     • Memory layout (total bytes, user data offset).
     • LOCK bits / CC byte (page 2).
     • AUTH0 byte (if present, for password-protection readiness).
     • Current content (first 64 bytes, or full memory).
   • MIFARE Classic (1K, 4K): Run nfc-mfclassic info or mfoc -O dump.bin to read:
     • UID (4 bytes).
     • Memory layout (16 or 40 sectors).
     • Key A / Key B per sector (attempt default keys; mfoc can brute-force known keys).
     • Access bits and sector trailer status.
     • Sector 0 Block 0 (manufacturer data).
5. Analyze lock state:
   • For NTAG21x: check lock bits in page 2. Report if dynamic lock bytes prevent write.
   • For MIFARE: check access bits in sector trailers. Report if sectors are read-only.
6. Estimate available free space for a new NDEF write.
7. Display a summary table:
   • UID (hex).
   • Type (NTAG213, MIFARE Classic 1K, etc.).
   • Total capacity (bytes).
   • User data area (bytes).
   • Lock status (locked, partially locked, unlocked).
   • Current NDEF content (first 50 chars or summary).
   • Estimated free space.
   • Password protection status (for NTAG21x, check if AUTH0 is set).

Output / side effects

• Terminal displays a structured report (table or formatted text).
• No write or modification.
• User can save the output or screenshot for records.

Safety / constraints

• Non-destructive: This skill only reads and analyzes.
• Key cracking (mfoc): If running mfoc to brute-force MIFARE Classic keys, inform the user that this may take 30–60 seconds. Only attempt if the user explicitly asks or if a write failed due to authentication.
• Locked tag warning: If the tag is partially or fully locked, clearly state which regions cannot be written and suggest password-protect if the user owns the tag.