Forem: Sushil Kumar Prajapat

🟢 Part 2: Android HCE Implementation — Build a Complete Type 4 NFC Tag with HostApduService

Sushil Kumar Prajapat — Tue, 17 Feb 2026 05:06:31 +0000

🚀 Introduction

In Part 1 we explored the architecture behind Android Host-Based Card Emulation (HCE), ISO-DEP, and APDU structure. In this Part 2, you will build a complete Android HCE implementation step-by-step using HostApduService, handling SELECT, READ, and response logic to emulate an NFC Type 4 Tag in Kotlin.

🔵 1. Android HCE Architecture

Reader → NFC Controller → Android OS → HostApduService → Response APDU

🔵 2. Project Setup

Android Studio
Min SDK 19+
Target SDK 36
Kotlin (recommended)
Required permissions (uses NFC)
Emulator vs physical device note (NFC only works on real devices)

Note: NFC HCE cannot be tested on many emulators — use a physical device with NFC support.

🔵 3. Create HostApduService

class MyHostApduService : HostApduService() {
 // Status Word on success (used in response)
    private val SUCCESS_SW = byteArrayOf(0x90.toByte(), 0x00.toByte())

    // Status Word in case of failure (used in response)
    private val FAILURE_SW = byteArrayOf(0x6a.toByte(), 0x82.toByte())
    override fun processCommandApdu(
        commandApdu: ByteArray?,
        extras: Bundle?
    ): ByteArray {

        if (commandApdu == null) return FAILURE_SW
        /*This block handles the SELECT command for the NDEF 
          application AID. When the NFC reader selects this AID, we 
          respond with 90 00 (success).*/
        // Match incoming APDU to SELECT Application AID
        if (commandApdu.contentEquals(SELECT_APP)) {
            return SUCCESS_SW
        }
         /*This block handles the SELECT command for the NDEF 
          application Capability Container. 
          When the NFC reader selects this CC, we 
          respond with 90 00 (success).*/
        // Match incoming APDU to SELECT CC File
        if (commandApdu.contentEquals(SELECT_CC)) {
            return SUCCESS_SW
        }

        return FAILURE_SW
    }

    override fun onDeactivated(reason: Int) {}
}

💠 Lifecycle Diagram

how HostApduService methods are called:

Android routes incoming ISO-DEP APDU commands to processCommandApdu() inside your HostApduService, where your logic determines the response.

💠 Flow Chart

Your implementation must follow this sequence to correctly emulate a Type 4 NFC Tag and avoid communication failures.

🔵 4. apduservice.xml

<host-apdu-service
    android:description="@string/app_name"
    android:requireDeviceUnlock="false">

    <aid-group android:category="other">
        <aid-filter android:name="D2760000850101"/>
    </aid-group>

</host-apdu-service>

🔵 5. AndroidManifest

<service
    android:name=".MyHostApduService"
    android:permission="android.permission.BIND_NFC_SERVICE"
    android:exported="true">

    <intent-filter>
        <action android:name="android.nfc.cardemulation.action.HOST_APDU_SERVICE"/>
    </intent-filter>

    <meta-data
        android:name="android.nfc.cardemulation.host_apdu_service"
        android:resource="@xml/apduservice"/>
</service>

🔵 6. Implement CC File Response

When receiving:

CLA = 0x00
INS = 0xB0

Return CC file bytes + 90 00.

🔵 7. Return NLEN

If LE == 2:

Return:

NLEN + 90 00

🔵 8. Return NDEF Data

Return:

NLEN + NDEF Message + 90 00

🔵 9. Security Considerations

HCE is software-based.

Important:

Not hardware-secure like Secure Element
Encrypt sensitive payload
Validate on backend
Prevent replay attacks
Add timeout/session control

🔵 10. Full Communication Sequence Diagram

Reader                     Android HCE
  │                              │
  │ --- SELECT AID ------------> │
  │ <--- 90 00 ----------------- │
  │ --- SELECT CC -------------->│
  │ <--- 90 00 ------------------│
  │ --- READ CC ---------------->│
  │ <--- CC DATA + 90 00 ------- │
  │ --- SELECT NDEF ------------>│
  │ <--- 90 00 ------------------│
  │ --- READ NLEN -------------->│
  │ <--- NLEN + 90 00 ---------- │
  │ --- READ NDEF -------------->│
  │ <--- DATA + 90 00 ---------- │

Common Mistakes

Forgetting to respond with correct status words
Not handling unknown APDU commands
Testing only on emulator (HCE requires real NFC hardware)
Not validating APDU length before parsing

🏁 Final Thoughts

In this article, we built a complete Android HCE Type 4 Tag implementation using HostApduService and handled the full APDU exchange sequence.

Host-Based Card Emulation allows Android to behave like a Type 4 NFC smart card using:

ISO 14443-4
ISO 7816-4
APDU communication
NDEF file structure

With this knowledge, you can build:

Access control apps
Enterprise NFC solutions
Identity systems
IoT pairing solutions

If you're building NFC or HCE-based systems and have questions, drop them in the comments — I’d love to discuss and help.

This concludes the 2-part deep dive into Android HCE.

🟢 Android HCE Deep Dive: ISO-DEP, APDU & NFC Type 4 Tag Architecture (Part 1)

Sushil Kumar Prajapat — Thu, 12 Feb 2026 09:46:03 +0000

This article gives you the foundational knowledge you need to build production-grade NFC applications on Android — a topic often glossed over in basic tutorials.

why a developer should care
what problem they’ll solve by reading this

In this article, you’ll learn how NFC works under the hood — from protocol layers to real card emulation structures — so you can confidently build production-ready Android HCE solutions.

Introduction

Host-based card emulation (HCE) turns an Android device into a contactless smart card without requiring secure hardware. This is the same technology behind mobile payments, access control, and NFC-based identity systems. In this article, you’ll learn how HCE works at the protocol level — from ISO-DEP and APDU to the Type 4 Tag architecture — so you can build reliable, production-ready Android NFC systems.

This is the same underlying technology used in:

Mobile payments
Access control systems
Digital identity cards
Smart ticketing
Enterprise badge systems

In this article, we’ll deeply explore:

NFC architecture layers
ISO-DEP protocol
APDU command structure
NFC Forum Type 4 Tag
NDEF file system structure

This is a technical deep dive for intermediate and advanced Android developers.

🔵 1. NFC Architecture Explained

Although NFC doesn’t strictly follow the OSI model, it can be logically understood in three layers:

+----------------------------+
|      Application Layer     |
|  (NDEF, Smart Card Logic)  |
+----------------------------+
|       Data Link Layer      |
|  (ISO-DEP, Error Control)  |
+----------------------------+
|       Physical Layer       |
|  (RF 13.56 MHz, NFC-A/B)   |
+----------------------------+

Physical Layer

13.56 MHz RF communication
NFC-A / NFC-B modulation
Handles signal transmission

Data Link Layer

ISO 14443-4 (ISO-DEP)
Frame structure
Error detection
Reliable data transfer

Application Layer

NDEF (NFC Data Exchange Format)
APDU commands
Smart card logic

🔵 2. What is ISO-DEP?

ISO-DEP (ISO 14443-4) is a higher-level NFC protocol that enables structured communication using APDUs.

It builds on top of:

NFC-A
NFC-B

Why ISO-DEP Matters?
Because Android HCE only supports:

ISO-DEP based card emulation
APDU command processing Without ISO-DEP → No HCE.

🔵 3. Understanding APDU (ISO 7816-4)

APDU (Application Protocol Data Unit) is the communication format between:

Reader ↔ Smart Card
NFC Terminal ↔ Android HCE

APDU Command Structure

CLA | INS | P1 | P2 | LC | DATA | LE

Field	Meaning
CLA	Class byte
INS	Instruction (Select, Read, Update)
P1/P2	Parameters
LC	Length of command data
DATA	Payload
LE	Expected response length

APDU Response Structure

DATA | SW1 | SW2

SW1 SW2	Meaning
90 00	Success
6A 82	File not found
6A 86	Incorrect parameters

Common status words.

🔵 4. NFC Forum Type 4 Tag Architecture

Type 4 Tag is built on:

ISO-DEP
APDU communication
File-based system (ISO 7816)

🧩 Type 4 Tag File System

In Type 4 Tags, the Capability Container (CC) file tells the reader how the tag is structured, and the NDEF file contains the actual NFC data.

NDEF Tag Application (AID)
│
├── CC File (E103)
│
└── NDEF File (E104)

🔵 5. Capability Container (CC) File

The CC file defines:

Mapping version
Maximum read size (MLe)
Maximum write size (MLc)
NDEF file identifier
Access permissions

CC File Structure

Offset 0x0000 → CCLEN
Offset 0x0002 → Mapping Version
Offset 0x0003 → MLe
Offset 0x0005 → MLc
Offset 0x0007 → NDEF File Control TLV

🔵 6. TLV (Tag-Length-Value) Blocks

TLV structure:

T | L | V

Example:

Tag = 04h → NDEF File Control TLV
Length = 06h
Value = 6 bytes describing NDEF file

🔵 7. NDEF File Structure

+----------------------+
| NLEN (2 bytes)       |
+----------------------+
| NDEF Message         |
+----------------------+

NLEN indicates the size of the NDEF message.

🔵 8. Complete APDU Flow (Reader → Android HCE)

1. SELECT NDEF Application
   00 A4 04 00 07 D2 76 00 00 85 01 01 00
2. SELECT CC File
   00 A4 00 0C 02 E1 03
3. READ CC File
   00 B0 00 00 0F
4. SELECT NDEF File
   00 A4 00 0C 02 E1 04
5. READ NLEN
   00 B0 00 00 02
6. READ NDEF Message
   00 B0 00 00 <length>

🔵 9. High-Level Architecture Diagram

🏁 Conclusion (Part 1)

In this article, we covered:

ISO-DEP fundamentals
APDU structure
Type 4 Tag architecture
CC file and TLV blocks
NDEF storage model

👉 In Part 2, we’ll build a full Android HCE implementation with real Kotlin code and examine how to handle SELECT and READ commands in HostApduService.

Why I Wrote This

I wrote this article to provide a deeper technical explanation of Android HCE beyond surface-level tutorials. Understanding ISO-DEP and APDU at the protocol level is essential when building reliable NFC systems.

💬 Let’s Discuss

Are you currently building an Android HCE or NFC-based application?

Do you have questions about ISO-DEP, APDU structure, or HostApduService implementation?

Drop your questions in the comments — I’d be happy to help and may address them in Part 2.