Hacking Spoofing an amiibo using Android+NFC?

[fatboynate]

all i want to know is, can it be done, YES or NO? a 3 character or less response will suffice.

 

[DinohScene]

Fox, Samus, Pit, Mega Man, Mario, Rosalina, Little Mac.. all these seem to be worth it. Except for Link, what the hell have they done to him?!

Nintendo, you should be ashamed of Link's Amiibo!

Haven't seen one IRL yet :c

 

[Kyohack]

Yes, this can be done. Data is identical per each dump. It's just a raw NFC tag with a few rewritable sectors. Nothing special, very easy to capture/emulate. See my post on researching Pokemon Rumble NFC figures for Wii U: https://gbatemp.net/threads/pokemon-rumble-u-nfc-data.353837/#post-4763104

Also see my research on the NFC tag info and Data pages that I've posted on Wii U brew: http://wiiubrew.org/wiki/Wii_U_GamePad
On there I've also listed some NFC hardware info covering the module itself, along with data that I've dumped from the figures.

Can this be implemented easily in a phone app for backup/restore capabilities? Yes. Can someone make a phone app to emulate their whole figure collection from a phone? Yes, but it's very difficult because you need a custom build of Cyanogenmod on Android because the default implementation of NFC in Android disables access to the phone's secure element for transmitting NFC.

You'll have better luck getting an NFC debug kit for a microcontroller. There are plenty of arduino NFC shields that have secure element access for NFC card emulation. Cheap stuff, $50.

ALSO TO NOTE:
For those of you who think "omg you're going to get sued into the ground," making a "backup archival copy" of your own NFC figure collection is perfectly legal. Nintendo has implemented raw NFC protocols in their products. They COULD have chosen to encrypt the transmission of the figure data but chose NOT to, so we are free to backup/restore to our heart's content. If encryption were being reverse-engineered, then yes, you might have to worry about DMCA, but there's no encryption in the figure transmission whatsoever.

 

[FPSRussi4]

all i want to know is, can it be done, YES or NO? a 3 character or less response will suffice.

Does the above post answer your question?

 

[fatboynate]

Yes, this can be done. Data is identical per each dump. It's just a raw NFC tag with a few rewritable sectors. Nothing special, very easy to capture/emulate. See my post on researching Pokemon Rumble NFC figures for Wii U: https://gbatemp.net/threads/pokemon-rumble-u-nfc-data.353837/#post-4763104

Also see my research on the NFC tag info and Data pages that I've posted on Wii U brew: http://wiiubrew.org/wiki/Wii_U_GamePad
On there I've also listed some NFC hardware info covering the module itself, along with data that I've dumped from the figures.

Can this be implemented easily in a phone app for backup/restore capabilities? Yes. Can someone make a phone app to emulate their whole figure collection from a phone? Yes, but it's very difficult because you need a custom build of Cyanogenmod on Android because the default implementation of NFC in Android disables access to the phone's secure element for transmitting NFC.

You'll have better luck getting an NFC debug kit for a microcontroller. There are plenty of arduino NFC shields that have secure element access for NFC card emulation. Cheap stuff, $50.

ALSO TO NOTE:
For those of you who think "omg you're going to get sued into the ground," making a "backup archival copy" of your own NFC figure collection is perfectly legal. Nintendo has implemented raw NFC protocols in their products. They COULD have chosen to encrypt the transmission of the figure data but chose NOT to, so we are free to backup/restore to our heart's content. If encryption were being reverse-engineered, then yes, you might have to worry about DMCA, but there's no encryption in the figure transmission whatsoever.

awesome and i actually run cyanogenmod on all my android devices that have a decent rom available, so how would i go about recording the nfc because when it comes to radio i am 100% retard atm (below noob level )

 

[lonesome_killer]

And this is the day that pirates are even pirating physical figurines.
Wow....

Come on, their 15 quid.
Prolly cheaper when buying them second hand later on...

In America they are $13 each. Times that by 48 playable characters, and you have a grand total of $624. So they're no longer just 15 quid. (even if you get lucky and get them at $5 used each which would be a steal, that's still $250) And like everyone on these forums that likes to use gameboy flash carts and carry around 20+ games in a single cartridge instead of 20 individual games, it would be nice to have 50 amiibos in something the size of a phone versus 50 physical items you'd have to carry around.

 

[fatboynate]

In America they are $13 each. Times that by 48 playable characters, and you have a grand total of $624. So they're no longer just 15 quid. (even if you get lucky and get them at $5 used each which would be a steal, that's still $250) And like everyone on these forums that likes to use gameboy flash carts and carry around 20+ games in a single cartridge instead of 20 individual games, it would be nice to have 50 amiibos in something the size of a phone versus 50 physical items you'd have to carry around.

thats right, i dont mind buying the actual figures, but i dont want to be having to keep taking them from the shelf each time i want to use them, its more conveniant to just load up a file with the right figures data and plop my phone down which means my nice nintendo figures can stay on display on the shelves.

 

[FPSRussi4]

thats right, i dont mind buying the actual figures, but i dont want to be having to keep taking them from the shelf each time i want to use them, its more conveniant to just load up a file with the right figures data and plop my phone down which means my nice nintendo figures can stay on display on the shelves.

Especially your Legend of Link one yeah?

 

[fatboynate]

yep haha glad you remembered it, what would be better is if i could use a pi to spoof the nfc with a say probe that i just put on the amiibo spot would be much simpler than putting my phone on my gamepad

EDIT: i actually own the link one already because i have a small collection of legend of link stuff

but i plan on getting more figures as the amiibo feature develops and when more games and software are using it.

 

[elmoemo]

Aaaaaaactually, this is not possible, and I'm certain its probably to prevent something like what you guys are talking about from happening. Anyway, the current security measures inside an Amiibo box is a small 1"x1" (ish) sheet of tin foil at the bottom inside the packaging that prevents communication with anything.

Disney infinity figures can be read through their boxes

 

[Master0fBlunt]

View attachment 12350

To everyone else, this would definitely be a good way to spoof an amiibo, but i'm not sure if you could exploit the system or something like that.

Correct. This would be a completely useless layer and hard/firmware to contemplate as a door. This simply would allow you to leave your toys safely on a shelf with finger grime, dust, scratches. I personally plan to collect as many as possible bc im a collector and fan, and id be tickled to death if i could spare my miibos from unnecessary environment exposure to preserve my investment. Like i stated earlier, having hundreds of people dl the same serialized file is useless, but to be able to backup your miibos and select one from a handheld device, now thats cool and convenient.

RFID can work from pretty big distances, sure, but these are specifically made to only work close by. Either way - being able to read them isn't really something that matters when you know the data format and can emulate them.

Yes, this is technically possible. The figures are Mifare Ultralight NFC tags, and the data is readable without any keys. Writing is locked, however. Most NFC enabled Android phones support Host-based Card Emulation, which could reproduce this information in a way readable for the gamepad. Theoretically.

Technically/theoretically possible doesn't mean it'll happen though.
If I have some free time I'll look into it. Reverse engineering stuff is a hobby of mine.

Please pm any info you have. Not only is it feasible, its just a matter of writing a gui/app. Btw im also the curious type. Id like to confirm or debunk this....

Disney infinity figures can be read through their boxes

My point exactly. Scanning rfids is NOT the issue, i can do that all day long. I need someone to write a basic gui for android and the rest i can take care of.....

 

[elmoemo]

My point exactly. Scanning rfids is NOT the issue, i can do that all day long. I need someone to write a basic gui for android and the rest i can take care of.....

If you do get something working let me know and I can test as well

 

[Master0fBlunt]

The paint job in their new condition isn't that solid much less being used by someone who probably dropped and more.

Most online retailers sell it for about £10, but ain't sure about retail stores.

Exactly, read previous post. My intent is less piratey, more convenience....

And this is the day that pirates are even pirating physical figurines.
Wow....

Come on, their 15 quid.
Prolly cheaper when buying them second hand later on...

Wrong. If people want to pirate, they can figure it out for themselves. I want to simply allow people to have their figures saved in an easily accessible library. Why nintendo didnt give us a code with every miibo to save in an online or other fashion is beyond me. Possibly coz sum1 could buy one, register it, sell it, and the buyer would be effed bc they cant associate that serial with their profile bc its already been used... Like the red nintendo rewards cards inside new nintendo wii u games... Once its registered, its done, no-one else can register that #. Im trying to build a workaround that allows an individual to save the items they purchase, nothing more....

If you do get something working let me know and I can test as well

Well, if you have an android less than a year old, and a miibo, you may be a candidate for beta. Ill post if one becomes compiled.

all i want to know is, can it be done, YES or NO? a 3 character or less response will suffice.

Its already confirmed and accomplished. Working on the details and gui however....

Where we're at:

Need rfid recorder.
Need broadcaster.
Need gui.

yep haha glad you remembered it, what would be better is if i could use a pi to spoof the nfc with a say probe that i just put on the amiibo spot would be much simpler than putting my phone on my gamepad

EDIT: i actually own the link one already because i have a small collection of legend of link stuff

but i plan on getting more figures as the amiibo feature develops and when more games and software are using it.

The hardware issue is on the backburner, first we need to have a finished app and success. Next is hardware. I think touching your phone to gamepad would be a MINOR inconvenience IMHO...

For now im gunna franken-f**k it with random crap hardware i can get my hands on. I want to build the code, the hardware, phone, wtfe is up to you guys lol. I wont leave you hangin, but i cant do it all...

thats right, i dont mind buying the actual figures, but i dont want to be having to keep taking them from the shelf each time i want to use them, its more conveniant to just load up a file with the right figures data and plop my phone down which means my nice nintendo figures can stay on display on the shelves.

Goal defined.

Yes, this can be done. Data is identical per each dump. It's just a raw NFC tag with a few rewritable sectors. Nothing special, very easy to capture/emulate. See my post on researching Pokemon Rumble NFC figures for Wii U: https://gbatemp.net/threads/pokemon-rumble-u-nfc-data.353837/#post-4763104

Also see my research on the NFC tag info and Data pages that I've posted on Wii U brew: http://wiiubrew.org/wiki/Wii_U_GamePad
On there I've also listed some NFC hardware info covering the module itself, along with data that I've dumped from the figures.

Can this be implemented easily in a phone app for backup/restore capabilities? Yes. Can someone make a phone app to emulate their whole figure collection from a phone? Yes, but it's very difficult because you need a custom build of Cyanogenmod on Android because the default implementation of NFC in Android disables access to the phone's secure element for transmitting NFC.

You'll have better luck getting an NFC debug kit for a microcontroller. There are plenty of arduino NFC shields that have secure element access for NFC card emulation. Cheap stuff, $50.

ALSO TO NOTE:
For those of you who think "omg you're going to get sued into the ground," making a "backup archival copy" of your own NFC figure collection is perfectly legal. Nintendo has implemented raw NFC protocols in their products. They COULD have chosen to encrypt the transmission of the figure data but chose NOT to, so we are free to backup/restore to our heart's content. If encryption were being reverse-engineered, then yes, you might have to worry about DMCA, but there's no encryption in the figure transmission whatsoever.

1. Goal defined.
2. Great info thank you.
3. Good nub info (shouldnt see any more uninformed posts about "ermagerd not possible")
4. Most droid users are SU/root. Great market bc these peeps already like to mod
5. Would like info on CyMod, relating to NFC.
6. Need someone capable of app writing... I can, but then the release will be much farther away lmao. I suck at droid apps.

 

[Wildblood]

I'm really surprised they haven't encrypted their amiibos, if what Master0fBlunt says is true. Basically, if Ninty wanted to make amiibos "unhackable", they could.

This was discussed in a recent thread (http://gbatemp.net/threads/possible-to-hack-amiibo.373149)

Long answer: NFC isn't a simple wireless barcode. The best way to imagine the amiibo is as a very weak, low-powered computer. When it comes close to an NFC reader, the reader transmits enough electricity to it, wirelessly, to turn it on. Then, they start talking to each other. Since they are both computers, the information can be encrypted (very well). The only way to decrypt it, is to know the keys. The encryption can be done via hardware (SAM modules - though I'm sure Ninty hasn't done this), or via software.

Basically what happens in layman's terms, is that, when an NFC/RFID card comes close to an NFC/RFID reader, the card is activated, through a weak wireless electrical signal. The card has some publically accessible data (ID, type of wireless technology, etc), and some private data. To access the private data, it is decrypted with specific keys. Different keys can give you different levels of access to the private data (ie, one key might let you read-only, another might let you write). Simply intercepting the packets or spoofing the public data of an NFC card, wouldn't let you actually spoof the card itself. If that were the case, with a simple reader you could get free bus/train rides in whatever city used RFID cards (Hong Kong, London, etc).

This isn't entirely accurate, but it's close enough that you get an idea of how hard it will be to hack, and also why you shouldn't expect to just scan it with your phone, then use your phone instead of an amiibo. Also I'm not sure if they use commonly accepted standards, or have any propriety ones. If they have propriety ones, then in all likelihood your phone wouldn't be able to emulate them, without a never-to-come firmware upgrade to your phone's NFC driver. To put this simply - the NFC language Nintendo uses, might not be the commonly-accepted language. It's like your phone speaks the international language of English, but the amiibo is programmed to only speak Klingon - and this is at the hardware-firmware level, so you can't download an app to translate for you.

Finally, I'd be surprised (and disappointed), if Ninty didn't bother using any decent encryption. RFID encryption has been around long enough that getting the know-how to do it, would be easy enough for them.

If someone feels I'm wrong about anything, please feel free to correct me.

 

[superspence]

Well, if you have an android less than a year old, and a miibo, you may be a candidate for beta. Ill post if one becomes compiled.

I've got an HTC One M8 (Like a month old) and a Mario Amiibo, id love to get in on this

 

[fatboynate]

I'm really surprised they haven't encrypted their amiibos, if what Master0fBlunt says is true. Basically, if Ninty wanted to make amiibos "unhackable", they could.

This was discussed in a recent thread (http://gbatemp.net/threads/possible-to-hack-amiibo.373149)

Long answer: NFC isn't a simple wireless barcode. The best way to imagine the amiibo is as a very weak, low-powered computer. When it comes close to an NFC reader, the reader transmits enough electricity to it, wirelessly, to turn it on. Then, they start talking to each other. Since they are both computers, the information can be encrypted (very well). The only way to decrypt it, is to know the keys. The encryption can be done via hardware (SAM modules - though I'm sure Ninty hasn't done this), or via software.

Basically what happens in layman's terms, is that, when an NFC/RFID card comes close to an NFC/RFID reader, the card is activated, through a weak wireless electrical signal. The card has some publically accessible data (ID, type of wireless technology, etc), and some private data. To access the private data, it is decrypted with specific keys. Different keys can give you different levels of access to the private data (ie, one key might let you read-only, another might let you write). Simply intercepting the packets or spoofing the public data of an NFC card, wouldn't let you actually spoof the card itself. If that were the case, with a simple reader you could get free bus/train rides in whatever city used RFID cards (Hong Kong, London, etc).

This isn't entirely accurate, but it's close enough that you get an idea of how hard it will be to hack, and also why you shouldn't expect to just scan it with your phone, then use your phone instead of an amiibo. Also I'm not sure if they use commonly accepted standards, or have any propriety ones. If they have propriety ones, then in all likelihood your phone wouldn't be able to emulate them, without a never-to-come firmware upgrade to your phone's NFC driver. To put this simply - the NFC language Nintendo uses, might not be the commonly-accepted language. It's like your phone speaks the international language of English, but the amiibo is programmed to only speak Klingon - and this is at the hardware-firmware level, so you can't download an app to translate for you.

Finally, I'd be surprised (and disappointed), if Ninty didn't bother using any decent encryption. RFID encryption has been around long enough that getting the know-how to do it, would be easy enough for them.

If someone feels I'm wrong about anything, please feel free to correct me.

i dont think nintendo would bother wasting time to encrypt these since they're designed for kids to use and most savvy parents wouldnt let their kids take their games consoles/accessories outside to play with them, the amiibo gimik is supposed to be a inside the home toy. its not like they expect kids age 7 to take their £200 handheld and £15 figures out just to play ssb.

EDIT: my point being is that the product is designed for kids, kids dont even know how to use a computer propperly, nintendo doesnt expect kids to back up their amiibo figures, which is why there is no encryption. and now i think about it, i dont want to use my phone as an amiibo because that takes the fun away from using the amiibo feature in the first place.

 

[FPSRussi4]

i dont think nintendo would bother wasting time to encrypt these since they're designed for kids to use and most savvy parents wouldnt let their kids take their games consoles/accessories outside to play with them, the amiibo gimik is supposed to be a inside the home toy. its not like they expect kids age 7 to take their £200 handheld and £15 figures out just to play ssb.

EDIT: my point being is that the product is designed for kids, kids dont even know how to use a computer propperly, nintendo doesnt expect kids to back up their amiibo figures, which is why there is no encryption. and now i think about it, i dont want to use my phone as an amiibo because that takes the fun away from using the amiibo feature in the first place.

Good point. They also didn't think kids would cause a buffer overflow in Zelda or find an exploit that's unpatchable in Smash. Doesn't mean people won't.

 

[mixelpixx]

Fpsrussia117 don't be like that. Just don't want kids to get scared. Most of the time the letter is a fishing expedition, not answering it or acting like "Username Wii-Pwner-With-A-Bwner.... never heard of him/her..." and move on.

Getting into RFID/NFC signal grabbing should be kinda easy, I mean you have to read, you have to learn, and an already existing competence in electronics wouldn't hurt.

Sparkfun.com is where I would suggest starting for purchasing stuff. Although you might be able to check Radioshack, they carry a bunch of project stuff now, and I know they carry "little bits" and there may be an RFID module they make, that would be cheap and somewhat breadboard-able.

*corps are def making progress brainwashing peeps, can't make it through one thread without hearing "piracy!" What I do with my hardware, that I purchased, is mine to whatever I like with. My attorney and the DMCA seem to disagree sometimes, but who cares? You only live once, get some knowledge, and use it.

 

[mixelpixx]

Wowzers. kinda nice. I just replied without realizing there were 2 pages here now.

Thank you Kyohack for the info and the thread..

 

[FPSRussi4]

What I do with my hardware, that I purchased, is mine to whatever I like with. My attorney and the DMCA seem to disagree sometimes, but who cares? You only live once, get some knowledge, and use it.

Hey master of blunt(and only you since you're the lead dev behind this app), I assume iphone can't get in on this because their lack of an NFC?