求问如何获取iOS向Mifare标签发送的底层原始数据样本及retryinterval参数问题

Hey Mario, great questions—let's tackle them one by one since this stuff can get a bit tricky with iOS's locked-down NFC stack:

获取iOS发送给MIFARE标签的原始ISO 14443底层数据 #

If you're after raw air-interface frames (including REQA/REQB and those unmodifiable APDUs iOS sends in the background), here are your best options:

• Hardware Sniffing: This is the most reliable method. iOS's NFC communication happens over the air, so you can use a dedicated NFC sniffer (like a Proxmark3 or professional NFC analysis tool) that supports ISO/IEC 14443-3/4 to capture every single frame exchanged. Even though Apple blocks write access, the initial discovery (REQA/REQB), anti-collision, and background APDU commands are all transmitted over the air—sniffers will catch all of these. Keep in mind that these frames can vary across iOS versions and device models (e.g., minor differences in anti-collision timing or REQA parameters).
• Memory Extraction & Reverse Engineering: This is far more complex and requires a jailbroken device. Apple heavily protects the nfcd (NFC daemon) process and CoreNFC framework memory. You could attempt to dump memory from nfcd to pull out recent communication data, or reverse-engineer CoreNFC's internal logic to infer the exact commands being sent. That said, this approach is fragile—Apple frequently changes internal NFC stack logic with system updates, so any findings might not hold across iOS versions.

What About the retryInterval Parameter? #

The retryInterval is iOS-specific, a high-level CoreNFC framework parameter—it does not map to any field defined in ISO/IEC 14443-3 or 4. It controls how long the CoreNFC framework waits before retrying a failed tag command, entirely part of Apple's upper-layer logic, not something that gets sent directly to the MIFARE tag over the low-level protocol.

内容的提问来源于stack exchange，提问作者Mario