[opensourcedex]

nfcgate is a free, open source threat detection & response project written in Java and released under Apache-2.0. It has 2,378 GitHub stars, 274 forks and 12 open issues, and was last pushed 2 months ago. On this registry it ranks #23 of 26 tracked projects in Threat Detection & Response, with 5 head-to-head comparisons available.

What is nfcgate?

NFCGate is an open-source Android application for capturing, analyzing, and modifying NFC traffic, built as a security research toolkit for reverse-engineering NFC protocols and testing them against modification.

What it is

NFCGate is an Android application developed for security research by students of the Secure Mobile Networking Lab at TU Darmstadt. It lives in the Android NFC ecosystem, requires Android 5+ (API level 21+) with NFC hardware, and is distributed through F-Droid as de.tu_darmstadt.seemoo.nfcgate. Written in Java and licensed under Apache-2.0, it provides on-device capture, relay, replay, and clone modes, and captured traffic can be exported to or imported from the pcapng format for analysis in Wireshark.

The concrete problem it solves is the difficulty of inspecting and modifying NFC traffic between an Android application and a tag. On-device capture records the NFC traffic sent and received by other applications running on the device, replacing the need to observe that traffic from outside the device. Relay mode forwards NFC traffic between two devices through the separate nfcgate/server component, with one device acting as a reader and the other emulating a tag using Host Card Emulation. Replay mode reuses previously captured traffic in reader or tag mode, and clone mode copies initial tag information such as the ID, enabling protocol reverse engineering and testing against modification.

Key capabilities

  • On-device capture records NFC traffic sent and received by other applications on the device, using an Xposed-compatible hooking framework such as EdXposed or LSPosed with Zygisk or Riru.
  • Relay mode uses the nfcgate/server component to forward NFC traffic between two devices: one operates as a reader, and the other emulates an NFC tag through Host Card Emulation (HCE).
  • Replay mode replays previously captured NFC traffic in either reader mode or tag mode.
  • Clone mode clones the initial tag information, such as the tag ID.
  • Captured traffic can be exported to and imported from pcapng files for analysis in Wireshark, as documented in doc/pcapng.md.
  • Relay confidentiality can be protected with Transport Layer Security (TLS) enabled in NFCGate settings, using a CA-issued or self-signed certificate; self-signed certificates can be trusted on first use (TOFU).

Who uses it and how

  • Security researchers and protocol reverse engineers use it to capture NFC traffic from other Android applications and export pcapng files for Wireshark analysis.
  • Teams assessing protocols against traffic modification use relay mode with nfcgate/server between two devices, one reading a tag and one emulating a tag via HCE.
  • Testers reproducing or copying tag behavior use replay mode in reader or tag mode, or clone mode for initial tag information such as the ID.
  • Deployment requires Android 5+ (API level 21+) with NFC support; hooking modes need an Xposed-compatible framework, and relay, replay tag mode, and clone mode require ARMv8-A or ARMv7 and HCE support.

Getting started

NFCGate is available from F-Droid as de.tu_darmstadt.seemoo.nfcgate, and can be built from source by running git submodule update --init and then building with Android Studio or Gradle. Mode-specific setup is described in the documents under doc/mode/.

How it compares

The provided facts name no comparable open-source NFC research toolkits and list no paid products that NFCGate replaces, so it stands alone in this registry on that basis. The adjacent tools mentioned are Wireshark, which reads exported pcapng captures, and an NFC tag-information application suggested for checking tag compatibility; neither performs NFC capture, relay, replay, or clone functions.

When to use it — and when not to

NFCGate is appropriate for security research and protocol assessment when the operator can provide an Android 5+ (API level 21+) device with NFC support, an Xposed-compatible hooking framework such as EdXposed or LSPosed for several modes, and ARMv8-A or ARMv7 hardware; relay additionally requires the separate nfcgate/server component and, for confidentiality, a CA-issued or self-signed TLS certificate. It should not be chosen by anyone who needs MiFare Classic support, because Android no longer supports those chips and NFCGate can only proxy tags that Android supports, with NFC-B and NFC-F untested. The project also carries an active warning that it is falsely detected as "NGate" malware and has 12 open issues.

project readme (upstream, from github) — read inline

NFCGate

⚠️NFCGate is currently being falsely detected as "NGate" malware. Please see this issue for up-to-date information.⚠️

NFCGate is an Android application meant to capture, analyze, or modify NFC traffic. It can be used as a researching tool to reverse engineer protocols or assess the security of protocols against traffic modifications.

Get it on F-Droid

Notice

This application was developed for security research purposes by students of the Secure Mobile Networking Lab at TU Darmstadt. Please do not use this application for malicious purposes.

Features

  • On-device capture: Captures NFC traffic sent and received by other applications running on the device.
  • Relay: Relays NFC traffic between two devices using a server. One device operates as a "reader" reading an NFC tag, the other device emulates an NFC tag using the Host Card Emulation (HCE).
  • Replay: Replays previously captured NFC traffic in either "reader" or "tag" mode.
  • Clone: Clones the initial tag information (e.g. ID).
  • pcapng export of captured NFC traffic, readable by Wireshark.

Requirements for specific modes

  • NFC support
  • Android 5+ (API level 21+)
  • Xposed-compatible hooking framework (EdXposed, LSPosed with Zygisk or Riru): On-device capture, relay tag mode, replay tag mode, clone mode.
  • ARMv8-A, ARMv7: Relay tag mode, replay tag mode, clone mode.
  • HCE: Relay tag mode, replay tag mode, clone mode.

Usage

Building

  1. Initialize submodules: git submodule update --init
  2. Build using Android Studio or Gradle

Operating Modes

As instructions differ per mode, each mode is described in detail in its own document in doc/mode/:

Pcapng Export

Captured traffic can be exported in or imported from the pcapng file format. For example, Wireshark can be used to further analyze NFC traffic. A detailed description of the import and export functionality is documented in doc/pcapng.md.

Compatibility

NFCGate provides an in-app status check. For further notes on compatibility see the compatibility document.

Known Issues and Caveats

Please consider the following issues and caveats before using the application (and especially before filing a bug report).

NFC Stack

When using modes, that utilize HCE, the phone has to implement the NFC Controller Interface (NCI) specification. Most of the phones should implement this specification when offering HCE support.

Confidentiality of Data Channel (relay)

To ensure confidentiality and integrity, use Transport Layer Security (TLS), which can be enabled in NFCGate settings. You need a CA-issued or self-signed certificate. Certificates from system-trusted CAs are trusted automatically. Self-signed certificates can be trusted by the user on first use ( TOFU).

Compatibility with Cards (relay, replay, clone)

We can only proxy tags supported by Android. For example, Android no longer offers support for MiFare classic chips, so these cards are not supported. When in doubt, use an application like NFC Tag info to find out if your tag is compatible. Also, at the moment, every tag technology supported by Android's HCE is supported (A, B, F), however NFC-B and NFC-F remain untested. NFC-A tags are the most common tags (for example, both the MiFare DESFire and specialized chips like the ones in electronic passports use NFC-A), but you may experience problems if you use other tags.

Compatibility with readers (relay)

This application only works with readers which do not implement additional security measures. One security measure which will prevent our application from working in relay mode is when the reader checks the time it takes the card to respond (or, to use the more general case, if the reader implements "distance bounding"). The network transmission adds a noticeable delay to any transaction, so any secure reader will not accept our proxied replies.
This does not affect other operating modes.

Android NFC limitations (relay, replay)

Some features of NFC are not supported by Android and thus cannot be used with our application. We have experienced cases where the NFC field generated by the phone was not strong enough to properly power more advanced features of some NFC chips (e.g. cryptographic operations). Keep this in mind if you are testing chips we have not experimented with.

Publications and Media

This application was presented at the 14th USENIX Workshop on Offensive Technologies (WOOT '20). An arXiv preprint can be found here.

An early version of this application was presented at WiSec 2015. The extended Abstract and poster can be found on the website of one of the authors. It was also presented in a brief Lightning Talk at the Chaos Communication Camp 2015.

Reference our Project

Any use of this project which results in an academic publication or other publication which includes a bibliography should include a citation to NFCGate:

@inproceedings {Klee2020Nfcgate,
    author = {Steffen Klee and Alexandros Roussos and Max Maass and Matthias Hollick},
    title = {NFCGate: Opening the Door for {NFC} Security Research with a Smartphone-Based Toolkit},
    booktitle = {14th {USENIX} Workshop on Offensive Technologies ({WOOT} 20)},
    year = {2020},
    url = {https://www.usenix.org/conference/woot20/presentation/klee},
    publisher = {{USENIX} Association},
    month = aug,
}

The initial NFCGate paper describing the first version of NFCGate can be cited as follows:

@inproceedings{Maass2015Nfcgate,
  title={DEMO: NFCGate: an NFC relay application for Android},
  author={Max Maass and Uwe M{\"u}ller and Tom Schons and Daniel Wegemer and Matthias Schulz},
  booktitle={Proceedings of the 8th ACM Conference on Security \& Privacy in Wireless and Mobile Networks},
  year={2015}
}

License

   Copyright 2015-2025 NFCGate Team

   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
   You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.

Contact

Used Libraries

Credits

  • ADBI: ARM and THUMB inline hooking

Frequently asked questions

Is nfcgate free to use?

nfcgate is open source under the Apache-2.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does nfcgate do?

An NFC research toolkit application for Android

What is nfcgate written in?

nfcgate is primarily written in Java. Its source is publicly available at https://github.com/nfcgate/nfcgate, and it has 2,378 GitHub stars.