Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time
              ██╗     ██╗      ███████╗██╗   ██╗███████╗███████╗███████╗██████╗ 
              ██║     ██║      ██╔════╝██║   ██║╚══███╔╝╚══███╔╝██╔════╝██╔══██╗
              ██║     ██║█████╗█████╗  ██║   ██║  ███╔╝   ███╔╝ █████╗  ██████╔╝
              ██║     ██║╚════╝██╔══╝  ██║   ██║ ███╔╝   ███╔╝  ██╔══╝  ██╔══██╗
              ███████╗███████╗ ██║     ╚██████╔╝███████╗███████╗███████╗██║  ██║
              ╚══════╝╚══════╝ ╚═╝      ╚═════╝ ╚══════╝╚══════╝╚══════╝╚═╝  ╚═╝

                   Authors: Chad Spensky (
                              Hongyi Hu (


LL-Fuzzer is a fuzzing framework built to fuzz NFC applications on android devices.


Hardware Requirements


To install all of the dependencies type:

$ ./

or follow the individual instructions below:

  • If you're using a 64bit machine, you must install the 32 bit libraries:

    $ sudo apt-get install ia32-libs

  • Some of the android stuff requires java:

    $ sudo apt-get install openjdk-7-jre

  • NFCPy depends on libusb:

    $ sudo apt-get install python-pip

    $ sudo pip install pyusb


For general help try:

$ python --help

An example of a real use case would be:

$ python -r tty:usb:0 -s 4d001f274acd31cf -D fuzz-configs/ndef/ -o testing

Phone Setup

There are some settings on android that make fuzzing a much more pleasurable experience.

  • Enable USB debugging through "Developer options" If you don't see this option go to "About phone" and tap the "Build number" a bunch of times.

  • Enable "Stay awake" under "Developer options"

  • Set "Screen Lock" to None under "Security"


Here are some example commands to test NFC functionality (All files in examples-nfc):

  • Emulate an NFC tag:

    $ ./ -b --mode=initiator --quirks=android < ndef

  • Read data from an NFC tag:

    $ ./

Code Architecture

  • RFID Reader / FrontEnd as named by nfcpy (e.g. Proxmark, Omnikey, PN532 board)
  • LL-Fuzzer provides full control over what this sends over the RFID channel
  • RFID Device (e.g. smartphone, tablet, etc.)
  • Provides an abstraction to interaction with NFC-enabled devices
  • RFID Message (e.g. NDEF, LLCP)
  • LL-Fuzzer supports numerous NFC message types
  • Generator
  • Generates inputs for fuzzing
  • Fuzzer
  • Drives fuzzing operation
  • Uses generator to generate fuzzed messages
  • Tells RFID reader to transmit fuzzed messages
  • Receives logs, etc. from RFID Device
  • Controls RFID stack on RFID device to reset state


It might be useful to interface the fuzzer with e-mail for very long jobs.

$ sudo apt-get install sendmail


Unreliable RF Transmission

During our own fuzzing, we had a very difficult time getting reliable NFC communication. To facilitate this, we used a book with the reader placed inside and the phone tapped to the top to prevent it from moving.
A more elegant setup is certainly possible, but any reliable setup will need a way of tweaking the distance and then holding the reader and phone at that fixed distance for the duration of the fuzzing.


Please use this DOI number reference, published on Zenodo, when citing the software:


This work is sponsored by the Defense Information Systems Agency under Air Force Contract #FA8721-05-C-0002. Opinions, interpretations, conclusions and recommendations are those of the author and are not necessarily endorsed by the United States Government.


An automated NFC fuzzing framework for Android devices.







No packages published