Source: Dev.to

🟢 Part 2: Android HCE Implementation — Build a Complete Type 4 NFC Tag with HostApduService

---

🚀 Introduction

In Part 1 we explored the architecture behind Android Host‑Based Card Emulation (HCE), ISO‑DEP, and APDU structure.
In Part 2 you will build a complete Android HCE implementation step‑by‑step using HostApduService, handling SELECT, READ, and response logic to emulate an NFC Type 4 Tag in Kotlin.

---

🔵 1. Android HCE Architecture

Reader → NFC Controller → Android OS → HostApduService → Response APDU

---

🔵 2. Project Setup

• Android Studio
• Min SDK: 19+
• Target SDK: 36
• Language: Kotlin (recommended)
• Permission: “
• Note: NFC HCE cannot be tested on most emulators – use a physical device with NFC support.

---

🔵 3. Create HostApduService

class MyHostApduService : HostApduService() {

    // Status Word on success (used in response)
    private val SUCCESS_SW = byteArrayOf(0x90.toByte(), 0x00.toByte())

    // Status Word in case of failure (used in response)
    private val FAILURE_SW = byteArrayOf(0x6a.toByte(), 0x82.toByte())

    override fun processCommandApdu(
        commandApdu: ByteArray?,
        extras: Bundle?
    ): ByteArray {

        if (commandApdu == null) return FAILURE_SW

        /* SELECT command for the NDEF application AID.
           When the NFC reader selects this AID we respond with 90 00 (success). */
        if (commandApdu.contentEquals(SELECT_APP)) {
            return SUCCESS_SW
        }

        /* SELECT command for the NDEF application Capability Container.
           When the NFC reader selects this CC we respond with 90 00 (success). */
        if (commandApdu.contentEquals(SELECT_CC)) {
            return SUCCESS_SW
        }

        return FAILURE_SW
    }

    override fun onDeactivated(reason: Int) {}
}

---

💠 Lifecycle Diagram

How HostApduService methods are called:

Android routes incoming ISO‑DEP APDU commands to processCommandApdu() inside your HostApduService, where your logic determines the response.

---

💠 Flow Chart

Your implementation must follow this sequence to correctly emulate a Type 4 NFC Tag and avoid communication failures.

---

🔵 4. apduservice.xml

---

🔵 5. AndroidManifest.xml

---

🔵 6. Implement CC File Response

When receiving a READ BINARY command (CLA = 0x00, INS = 0xB0) for the Capability Container (CC) file, return the CC file bytes followed by 90 00.

---

🔵 7. Return NLEN

If the reader requests the NDEF length (LE == 2), respond with:

[NLEN (2 bytes)] + 90 00

---

🔵 8. Return NDEF Data

When the reader requests the actual NDEF payload, respond with:

[NLEN] + [NDEF Message] + 90 00

---

🔵 9. Security Considerations

• HCE is software‑based; it is not as secure as a Secure Element.
• Encrypt any sensitive payload before storing it in the tag.
• Perform backend validation of received data.
• Implement replay‑attack protection (e.g., nonces, timestamps).
• Add session timeout or explicit deactivation logic.

---

🔵 10. Full Communication Sequence Diagram

Reader                     Android HCE
  │                              │
  │ --- SELECT AID ------------> │
  │ │
  │ │
  │ │
  │ │
  │ │
  │ │
│ <--- DATA + 90 00 ---------- │

---

Common Mistakes

• Forgetting to respond with correct status words
• Not handling unknown APDU commands
• Testing only on emulator (HCE requires real NFC hardware)
• Not validating APDU length before parsing

---

🏁 Final Thoughts

In this article, we built a complete Android HCE Type 4 Tag implementation using HostApduService and handled the full APDU exchange sequence.

Host‑Based Card Emulation allows Android to behave like a Type 4 NFC smart card using:

• ISO 14443‑4
• ISO 7816‑4
• APDU communication
• NDEF file structure

With this knowledge, you can build:

• Access‑control apps
• Enterprise NFC solutions
• Identity systems
• IoT pairing solutions

If you’re building NFC or HCE‑based systems and have questions, drop them in the comments — I’d love to discuss and help.

This concludes the 2‑part deep dive into Android HCE.