NFC Internals in Android: From APDU to NCI and RF

This talk follows the complete path of reading an NFC-enabled electronic document on Android through one end-to-end failure: the text data is available, but reading the face image from DG2 stops with a TagLostException.

We will first separate the camera and OCR stage from the NFC session by looking at the MRZ, check digits, the LDS file structure, DG1, DG2, EF.SOD, and the role of PACE or BAC in establishing secure messaging.

Then we will examine SELECT and READ BINARY APDUs and trace IsoDep.transceive() through NfcService, JNI, the native NFC stack, and the HAL to the NFCC. At the NCI layer, we will cover control and data packets, ConnID, PBF, and credit flow control, while keeping NCI fragmentation separate from application-level file reads and ISO-DEP chaining over RF.

We will also discuss discovery and activation, the ReaderCallback boundary, and why the same TagLostException can hide a timeout, deactivation, an application lifecycle error, or an unstable RF link. Using an SDK log and an NCI trace, we will correlate the last confirmed READ BINARY operation with DATA_TX, an RF timeout, and RF_DEACTIVATE_NTF without turning hypotheses into facts.

We will explain why an ambiguous failure does not permit replaying the same protected APDU and how to recover safely by starting a new activation and PACE/BAC session.

Finally, we will build a practical diagnostic and A/B testing workflow across phone models, document placement, cases, and block sizes.

Attendees will leave able to localize a failure between the application, the Android NFC stack, the NFCC, and the RF link, and to choose tests that validate the cause instead of merely hiding the symptom.