Ever since stumbling over Cyrill Künzi’s article about the Sonicare brush head timer reset (which I’ve written about here), I’ve wondered what else is stored in the data.
This is what a dump of the Mifare Ultralight NTAG213‘s memory from a white Sonicare A3 Premium All-in-One head looks like:
The memory is organised into “pages” with each page holding 4 Bytes.
| Page | Byte 0 | Byte 1 | Byte 2 | Byte 3 |
|---|---|---|---|---|
| 0x00 | UID0 | UID1 | UID2 | BCC0 |
| 0x01 | UID3 | UID4 | UID5 | UID6 |
| 0x02 | BCC1 | Internal | Lock & Block-Locking | |
| 0x03 | OTP | |||
| 0x04 – 0x27 | USER PAYLOAD | |||
| 0x28 | Dynamic Lock & Block-Locking | RFU | ||
| 0x29 | MIRROR | RFU | MIRROR_PAGE | AUTH0 |
| 0x2A | ACCESS | RFU | ||
| 0x2B | Password | |||
| 0x2C | Password ACK | RFU | ||
| 0x2D (Write-only) | NFC Counter (LSB 0 – MSB 2) | CNT_WR_CTRL | ||
| 0x2E – 0x35 (Write-only) | Signature | |||
I’m mostly interested in the payload data, i.e. the data that Philips defined. This is what I’ve deduced so far:
| Address | Page(s) | Contents |
|---|---|---|
| 0x04 | TLV record of type 0x03 (NDEF message) with length 0x20 (32 Bytes) | |
NDEF type 0x55 (URL) with prefix 0x02 (https://www.)to philips.com/cfcbrushheadtap | ||
| 0x32 | 0x0C | TLV end marker 0xFE |
| 0x7D | 0x1F | Unknown 0x00 or 0x01 value |
| 0x7E | 0x1F | Brush head type (as they show up in the app):0x01 = Premium Plaque Defence, White0x02 = Premium Plaque Defence, Black0x03 = Premium Gum Care, White0x04 = Premium Gum Care, Black0x05 = Premium White, White0x06 = Premium White, Black0x07 = Optimal Plaque Defence, White0x08 = Optimal Gum Care, White0x09 = Optimal White, White0x0A = Optimal White, Black0x0B = Optimal White (small), White0x0C = InterCare, White0x0D = InterCare (small), White0x0E = TongueCare+, White0x0F = TongueCare+, Black0x10 = Premium All-in-One, White0x11 = Premium All-in-One, Black0x12 = SimplyClean, White0x13 = ProResults, White0x14 = Sensitive, White0x15 = Sensitive, Black0x16 = Gentle Clean, WhiteAll other values seem to show up as whatever valid value was scanned last. |
| 0x20 | Unknown 0x00, 0x02, or 0x04 value | |
| 0x83 | 0x20 | Unknown 0x01 or 0x02 value |
| 0x21 | Intended total runtime for this head Usually 0x5460 = 21600 seconds = 6 hours, or 180 brush sessions with each session assumed to being 2 minutes | |
| 0x21 – 0x23 | Brush head MFG code as ASCII, e.g. 241206 31K(also printed on stem) – manufactured 6 Dec 2024, the 31K is probably the machine and location | |
| 0x24 | Accumulated runtime in seconds Here: 0x52F4 = 21236 seconds, or almost 177 sessions | |
| 0x92 | 0x24 | Last intensity:0x00 = Low0x01 = Med0x02 = High |
| 0x93 | 0x24 | Last brush mode:0x00 = Clean0x01 = White+0x02 = Gum Health0x03 = Deep Clean+( 0x04 = Sensitive? (not supported by my model)) |
| 0x9F | 0x27 | Unknown 0x01 value |
Some (older?) brush heads have the NDEF tag point to just
philips.com instead. Type and prefix are identical. (See here.)I will update the table once I find out new information.
Head Identifier?
This is a collection of data samples to try to figure out a way of identifying the different head types from the data.
| Brush Type and Colour | Page 0x1F | Page 0x20* | Page 0x27 |
|---|---|---|---|
| A3 Premium All-in-One, White | 00 01 10 00 | 00 00 04 02 | 00 00 00 01 |
| W DiamondClean, Black | 00 01 07 00 | 00 00 00 02 | 00 00 00 01 |
| Unknown 1 | 00 00 00 00 | 00 00 02 01 | 00 00 00 01 |
| Unknown 2 | 00 01 02 00 | 00 00 00 02 | 00 00 00 01 |
* read-only
Likes
Reposts