AwesomeREA.org

Case study

a0rfid: an open driver for A0-protocol UHF RFID readers

Reconstructs the A0 serial protocol of R2000-family 915 MHz UHF RFID desktop readers, which ship with only Windows software and an Android app, from the vendor app's native command encoder rather than its misleading Java SDK. A userspace CH340 driver, a Python CLI and GUI, and a small Android app then talk to the reader directly for inventory and tag-memory reads. docs/PROTOCOL.md records the frame layout, checksum, command table, response formats and the different field orders of READ and WRITE.

Targets
Protocol
Category
Independent reconstruction cases
Relationship
Independent reconstruction project
Sources reviewed

Requirements & limits

  • The reviewed main commit of 2026-09-17 is the second of two commits, with no tags or releases. docs/REVERSE.md describes decompiling the vendor APK, finding that the app bypasses its Java codec and calls libnative-lib.so through JNI, reading per-command field layouts from that library's rfid_encode() jump table, and then confirming the frames on hardware. The result is a protocol description and new host software; no reader firmware or vendor app is recovered, and the reader model is not named beyond the R2000 family.
  • Using the tools requires a compatible A0-protocol reader on its CH340 USB-UART at 115200 8N1, plus tags to test with. Repeating the analysis requires the vendor's own software package and manual, which are not included: REVERSE.md states that the repository contains no vendor code, only frames observed on the wire and code written from them. android/RFID助手.apk is the project's own prebuilt app, built from android/app by android/build.sh.
  • The Python tools need Python 3 with pyusb and pyserial. --port USB uses the bundled ch340_usb.py userspace driver, which on macOS needs Homebrew libusb; Linux can instead use the stock ch341 kernel driver through /dev/ttyUSB0. The Android app needs Android 7.0+ with USB host; android/build.sh assumes macOS/Homebrew paths, JDK 17, Android SDK platform 34 and build-tools 34.0.0.
  • test_offline.py runs 17 hardware-free checks of checksums, frame construction and response parsing, several against frames the author recorded from a reader reporting firmware V2.4.1, and docs/ANDROID.md reports 261 offline Android checks against simulated tags. The author reports confirming the read and write paths on one reader and installing and reading with the app on one DJI Smart Controller Enterprise (Android 7.1.2); the app's multi-bank write features were checked only in simulation. The docs also note occasional firmware hangs and a 20 dBm maximum power on the author's unit. This collection ran none of the tools.
  • MIT License (2026, a0rfid contributors); the vendor software, SDK and reader firmware keep their own terms. Write, lock and kill commands change real tags; this entry covers the protocol analysis and read path and does not describe the apps' write workflows. The reviewed sources establish no REA or AI use.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · uaih3k9x/a0rfid · Revision 944ec15
  2. docs/REVERSE.md GitHub · uaih3k9x/a0rfid · Revision 944ec15
  3. docs/PROTOCOL.md GitHub · uaih3k9x/a0rfid · Revision 944ec15
  4. docs/ANDROID.md GitHub · uaih3k9x/a0rfid · Revision 944ec15
  5. rfid_tool.py GitHub · uaih3k9x/a0rfid · Revision 944ec15
  6. ch340_usb.py GitHub · uaih3k9x/a0rfid · Revision 944ec15
  7. test_offline.py GitHub · uaih3k9x/a0rfid · Revision 944ec15
  8. android/build.sh GitHub · uaih3k9x/a0rfid · Revision 944ec15
  9. LICENSE GitHub · uaih3k9x/a0rfid · Revision 944ec15

More in Protocols

All 66 entries in ProtocolsProtocols case studies (26)