TagLostException with FeliCa tag

Question

I have a FeliCa Lite S tag that I am trying to read information from. My problem is that i get TagLostException whenever i execute a trancieve command. The following code should read the first block in my tag according to "FeliCa Lite-S User's manual" (ref: http://www.sony.net/Products/felica/business/tech-support/data/fls_usmnl_1.2.pdf), but instead it throws the TagLostException:

NfcF tech = NfcF.get(tag);
byte[] id = tech.getManufacturer();
byte[] sc = tech.getSystemCode();
byte[] res;
try {
    tech.connect();
    res = tech.transceive(new byte[] {0x06,id[0],id[1],id[2],id[3],id[4],id[5],id[6],id[7],0x01,sc[0],sc[1],0x01,0x00});
} finally {
    tech.close();
}

What am i doing wrong?

I have also tried with the poll command, and this also gives the TagLostException

byte[] pollRes = technology.transceive(new byte[] {
        0x00,       // poll command
        SC[0],      // system code B1 (FF -> any)
        SC[1],      // system code B2 (FF -> any)
        0x01,       // request code (0x00 == none)
        0x00       
        });

Any help is greatly appreciated!

Edit 1:

After reading this post: http://code.google.com/p/android/issues/detail?id=15389 I altered the poll command to include a byte containing the length of the package, and that gave a responce to the polling.

res = tech.transceive(new byte[] {0x06, 0x00, sc[0], sc[1], 0x01, 0x00});

I tried to do the same to my read command, (including changing block list item to consist of 2 bytes), but the result is still the same:

tech.transceive(new byte[] {0x10, 0x06,id[0],id[1],id[2],id[3],id[4],id[5],id[6],id[7],0x01,sc[0],sc[1],0x01,0x80,0x00});

Answer 1

First, addressed FeliCa command frames are of the form

+----------+----------+--------------------+--------------------+
|   LEN    |   CMD    |        IDm         |     Parameters     |
| (1 byte) | (1 byte) |     (8 bytes)      |  (LEN - 10 bytes)  |
+----------+----------+--------------------+--------------------+

So your command lacks the length byte (LEN).

Second, the FeliCa light service codes are typically 0x000B (read-only) and 0x0009 (read-write) whereas the system code you get with the getSystemCode() method would typically be 0x88 0xB4. So using the system code as service code in the read command usually does not make sense.

Third, each entry in the block list is two bytes long (or three bytes long if you want to encode block numbers above 255). The first of these bytes contains the access mode bits and the indicator if the block-list entry is two or three bytes long.

So the read command would look like this:

+------+------+-----+------+-------------+------+-------------+
| LEN  | CMD  | IDm |  Ns  |  Service 0  |  Nb  |   Block 0   |
| 0x10 | 0x06 | ... | 0x01 | 0x0B | 0x00 | 0x01 | 0x80 | 0x00 |
+------+------+-----+------+-------------+------+-------------+

or

+------+------+-----+------+-------------+------+--------------------+
| LEN  | CMD  | IDm |  Ns  |  Service 0  |  Nb  |      Block 0       |
| 0x11 | 0x06 | ... | 0x01 | 0x0B | 0x00 | 0x01 | 0x00 | 0x00 | 0x00 |
+------+------+-----+------+-------------+------+--------------------+

Answer 2

When I take a look in the datasheet I see the following:

• The service code list sc has to be in Little Endian
• The block list only includes 1 Byte 0x00, but should be minimum 2 bytes

Maybe it is possible to get more information from the exception?