Mifare Ultralight: lock specific pages

Question

I got reference from this link (Mifare Ultralight C Lock) to make all pages on a Mifare Ultralight tag read-only.

I can write a message on a Mifare Ultralight tag successfully on Android. Now I want to lock pages 4 to 7 (or any specific page). The above link only shows how to lock all pages. How I can lock specific pages?

This code locks all pages:

mifare.transceive(new byte[] {
    (byte)0xA2,  /* CMD = WRITE */
    (byte)0x02,  /* PAGE = 2    */
    (byte)0x00, (byte)0x00, (byte)0xFF, (byte)0xFF  /* DATA = lock pages 3..15*/
});

public static boolean writeOnMifareUltralight(Context _context, Tag tag,String pageData, int i) {
    byte[]result;
    MifareUltralight mifare = null;
    try {

        mifare = MifareUltralight.get(tag);
        mifare.connect();
        mifare.writePage(i, pageData.getBytes(Charset.forName("US-ASCII")));

        mifare.transceive(new byte[] {
            (byte)0xA2,  /* CMD = WRITE */
            (byte)0x02,  /* PAGE = 2    */
            (byte)0x00, (byte)0x00, (byte)0xFF, (byte)0xFF/* DATA = lock pages 3..15*/
        });
    } catch (Exception ex) {
        ex.printStackTrace();
        Log.d("mtw", ex.getMessage());
        // return false;
    } finally {
        try {
            mifare.close();
        } catch (Exception ex) {
            ex.printStackTrace();
        }
    }
    return true;
}

Answer 1

The lock bytes of MIFARE Ultralight use one bit to lock one block. In addition they contain 3 block locking bits that control the lock status of the lock bytes themselves.

• Byte 2 (on page 2): Bits 3-7 are the lock bits for pages 3-7. Thus, bit 3 locks page 3, bit 4 locks page 4, etc. The lower three bits are the block locking bits. Bit 0 locks the lock bit for page 3, bit 1 locks the lock bits for pages 4-9, and bit 2 locks the lock bits for pages 10-15.

• Byte 3 (on page 2): Bits 0-7 are the lock bits for pages 8-15. Thus, bit 0 locks page 8, bit 1 locks page 9, etc.

So, for example, to lock pages 4-7, you could use the following command:

mifare.transceive(new byte[] {
    (byte)0xA2,  /* CMD = WRITE */
    (byte)0x02,  /* PAGE = 2    */
    (byte)0x00, (byte)0x00, (byte)0xF0, (byte)0x00 /* DATA = lock pages 4..7*/
});

Note that instead of mifare.transceive() you could also simply use mifare.writePage():

mifare.writePage(2, new byte[] {
    (byte)0x00, (byte)0x00, (byte)0xF0, (byte)0x00 /* DATA = lock pages 4..7*/
});

Keep in mind that lock bits are one-time-programmable. Hence, once a lock bit is set to logical 1 (i.e. LOCKED), it can't be reversed to a logical 0 (i.e. UNLOCKED).

This also allows you to set one lock bit at a time. For instance, to set page i LOCKED (where 3 <= i <= 15 !!!), something like this should work:

mifare.transceive(new byte[] {
    (byte)0xA2,  /* CMD = WRITE */
    (byte)0x02,  /* PAGE = 2    */
    (byte)0x00, (byte)0x00, (byte)((1<<i) & 0x0FF), (byte)(((1<<i)>>>8) & 0x0FF)
});