android - Is there an NFC API for the Smartwatch 3 (SWR50)

Question

Just to be sure and have clarification of that at first, is the NFC of the Smartwatch 3 just an embedded tag or is it a theoretically fully functioning NFC-chip?

Hoping it's not just a tag, we want to build an Android Wear app using NFC and for this the biggest question is:

• Is there (gonna be?) a API to use the NFC chip of the SWR50?
• If not is there any other way to activate it, or maybe might an updated version of Android Wear bring support for the chip to the smartwatch? Any help is appreciated!

Thanks, Chris

---

TLDR: Basically it's the same question for the new smartwatch 3 of sony: Is NFC usable for developers? Is there an NFC API for the Sony SmartWatch 2?

Answer 1

I finally got my hands on one of those smart watches. This is what I found so far.

1. Scanning the SWR50 as a tag:

   The SWR50 is identified as an NFC Forum Type 2 Tag manufactured by Broadcom. The 7-byte-UID of the watch that I tested is 2e020d00000000. Both, the fact that I could not find any dedicated Type 2 tags from Broadcom and the many zeros in the UID, make me think that this might be a tag emulated using some NFC controller.

   The tag has 122 blocks (times 4 bytes makes 488 bytes in total) containing the following data:

    0: 2e 02 0d 0c     1: 00 00 00 00
    2: 00 00 ff ff     3: e1 11 3c 0f
    4: 00 00 00 01     5: 03 78 30 35
    6: 03 31 d4 0f     7: 1f 61 6e 64
    8: 72 6f 69 64     9: 2e 63 6f 6d
   10: 3a 70 6b 67    11: 63 6f 6d 2e
   12: 67 6f 6f 67    13: 6c 65 2e 61
   14: 6e 64 72 6f    15: 69 64 2e 77
   16: 65 61 72 61    17: 62 6c 65 2e
   18: 61 70 70 fe    19: ff ff ff ff
   20: 30 a8 db f2    21: 43 1c ff ff
   22: 30 a8 db f5    23: 2a 78 ff ff
   24: 14 39 2d 4d    25: f2 6a 91 40
   26: ff ff ff ff    27: ff ff ff ff
   (remaining blocks are all filled with ff ff ff ff)
   

   • The static lock bits (block 2, bytes 2 and 3) are all set (indicates locked state).

   • Block 3 contains a capability container for a Type 2 tag (magic byte 0xE1).

   • However, the mapping version number 1.1 (0x11) does not comply to any of the current mapping version documents provided by the NFC Forum! The only mapping version number that is currently defined is 1.0.

   • Block 4 contains 3 NULL TLVs (0x00) and the first byte of a Lock Control TLV (tag 0x01).

   • The Lock Control TLV indicates that there are 48 lock bits located starting at byte position 232 (= 7 * 2⁵ + 8). I.e. 6 bytes starting at block 58, so they are all set (0xFFFFFFFFFFFF). Each lock bit locks 3 bytes, so they indicate that blocks 16 to 51 are locked.

   • Block 6 contains the start of an NDEF Message TLV (tag 0x03, length 0x31). The NDEF message consists of a single NDEF record (Android Application Record for app com.google.android.wearable.app):

     +--------------------------------------------+
     | TNF:  EXTERNAL TYPE                        |
     | Type: urn:nfc:ext:android.com:pkg          |
     +--------------------------------------------+
     | Payload: com.google.android.wearable.app   |
     +--------------------------------------------+
     

   • Block 18 contains a Terminator TLV (tag 0xFE) indicating the last TLV block within the tag memory area.

   • Blocks 20 and 21 (first 2 bytes) contain the device Bluetooth address.

   • Blocks 22 and 23 (first 2 bytes) contain something that looks like a Bluetooth address too.

   • Blocks 24 and 25 contain the device serial number.

   • The remaining blocks are all filled with FF FF FF FF.

2. Android NFC API access:

   Requesting an instance of the NFC adapter fails (the getDefaultAdapter() method returns null):

   NfcManager nfcMgr = (NfcManager)mContext.getSystemService(Context.NFC_SERVICE);
   NfcAdapter nfcAdapter = nfcMgr.getDefaultAdapter();  // -> null
   

   In addition there is a log message that the device does not support NFC.

   V/NFC: this device does not have NFC support
   

   Looking at the NFC system features, none of the NFC system features are available:

   PackageManager pkgMgr = mContext.getPackageManager();
   boolean featureNfc = pkgMgr.hasSystemFeature("android.hardware.nfc");     // -> false
   boolean featureHce = pkgMgr.hasSystemFeature("android.hardware.nfc.hce"); // -> false
   

   Both featureNfc and featureHce are false, so neither android.hardware.nfc nor android.hardware.nfc.hce are available.

   So there is currently no NFC API available on the SWR50.

3. Firmware analysis:

   • There is a file named BCM43341B0_002.001.014.0122.0174.hcd under /system/vendor/firmware/, so it seems that the watch actually does contain Broadcom's BCM43341 quad-radio chip which also contains an NFC controller.
   • /proc/misc lists bcm2079x, so it seems that the bcm2079x driver was compiled into the kernel.
   • There is no NFC service app (Nfc*.apk) on the /system partition.

   So there might be support for NFC from the hardware side and the kernel side, but the user-space part of the NFC stack is missing. Though the kernel driver might just as well point to nowhere. And the firmware of the BCM43341 might be coded in a way that the NFC controller simply emulates the Type 2 tag while being inaccessible from the operating system.