CardEmu

CardEmu is an Android system-level application for emulating NFC cards.

The app can:

• scan and store 4-, 7-, and 10-byte NFC tag UIDs;
• apply or restore a UID through a constrained daemon;
• expose saved cards through Quick Settings, Android device controls, and Quick Access Wallet;
• back up and import cards as versioned JSON;
• write a 4-byte UID to block 0 of a compatible rewritable-UID MIFARE Classic card.

It does NOT copy card memory, cryptographic keys, access rights, balances, or payment credentials.

Repository layout

• app/ — Kotlin Android app and unit tests.
• daemon/ — Kotlin root companion exposing a narrow Binder API in system-image builds.
• ipc/ — shared AIDL contract and parcelable response used by the app and daemon.
• system_ext/ — init, privileged-permission, and SELinux integration for the system-ext image.
• Android.bp — AOSP/Soong modules.

Development build

The Gradle build compiles the APK and runs host-side parser tests:

./gradlew testDebugUnitTest assembleDebug

A Gradle APK is useful for UI development only. It cannot apply NFC controller configuration because ordinary apps cannot create bind mounts or restart the NFC stack. Production use requires the complete AOSP integration.

Gradle packages the daemon sources as an Android library so its Binder endpoint is compiled and linted in CI. That AAR is not deployed; Soong produces the installable /system_ext/framework/cardemud.jar used by app_process.

AOSP build

Add this directory to PRODUCT_SOONG_NAMESPACES, include CardEmu in PRODUCT_PACKAGES, and merge the system-ext SELinux policy described in SYSTEM_INTEGRATION.md. Every CardEmu runtime artifact is installed on system_ext: the platform-signed privileged APK, Kotlin daemon JAR, launcher, init configuration, Binder service policy, and privileged permission allowlist.

You may need a sepolicy workaround like https://github.com/android-kxxt/android_patches/blob/main/23/device/xiaomi/sm8450-common/0001-sm8450-common-sepolicy-allow-NFC-HAL-to-read-CardEmu.patch.

Safety

Use CardEmu only with cards and systems you are authorized to test. Restoring the original configuration unmounts every runtime overlay; a normal reboot also removes bind mounts, after which cardemud reapplies only the explicitly persisted selection. CUID writing is opt-in and warns before touching manufacturer block 0.