Hacking Spoofing an amiibo using Android+NFC?

[Pecrow]

I don't think it's full yet.

where is the thread?

 

[elmoemo]

where is the thread?

Here - http://gbatemp.net/index.php?threads/Announcing-the-amiiqo---Switch-amiibo's-with-ease!.393396/

But the link has been removed just incase

 

[fiveighteen]

So what kind of NFC tag does this Amiiqo use that nobody else can seem to find?

 

[mdmwii]

So what kind of NFC tag does this Amiiqo use that nobody else can seem to find?

It's a weird chip called SX3.

Review: https://www.reboot.ms/forum/threads/amiiqo.523/

 

[fiveighteen]

It's a weird chip called SX3.

Review: https://www.reboot.ms/forum/threads/amiiqo.523/

Thanks for the link. Unfortunately, it appears that nobody knows what that chip actually is though.

 

[fiveighteen]

I found a product (unrelated to Wii U/Android) that shows:
Communication Interfaces: RS232 / RS485 ciphered with AES-128bits (SX2 / SX3)

So it seems like SX3 is for security? RS232 works for ISO14443A (Amiibo chips).

Someone has created an Amiibo Decryption Service, where you send your encrypted amiibo.bin file to a server and it decrypts it for you. I made a bash script that runs through Cygwin (requires nc; netcat) so you can easily decrypt a single file or decrypt all files in a folder. Open with Notepad++ or similar and change your location folder and your decrypted location folder (where the .bin files are, and where you want the decrypted .bin files to go). Double-click it to run from anywhere.

 

[NWPlayer123]

I found a product (unrelated to Wii U/Android) that shows:
Communication Interfaces: RS232 / RS485 ciphered with AES-128bits (SX2 / SX3)

So it seems like SX3 is for security? RS232 works for ISO14443A (Amiibo chips).

Someone has created an Amiibo Decryption Service, where you send your encrypted amiibo.bin file to a server and it decrypts it for you. I made a bash script that runs through Cygwin (requires nc; netcat) so you can easily decrypt a single file or decrypt all files in a folder. Open with Notepad++ or similar and change your location folder and your decrypted location folder (where the .bin files are, and where you want the decrypted .bin files to go). Double-click it to run from anywhere.

Well that makes my life easier, may as well translate the full including what's on the servers to python now.

 

[asper]

NWPlayer what is the format of the amiibo dump ? Raw nfc block content ?

 

[socram8888]

NWPlayer what is the format of the amiibo dump ? Raw nfc block content ?

Yes

 

[KungFuzion]

I ordered my amiiqo 2 days ago. Check out the nfc bank, there's loads of dumps on there.

 

[asper]

Well, with amiiqo (the "q" is a reversed "b", have you ever noticed it ) everyone can have a full load of virtual toys...
But with socram888 service it will be fun to see how data is stored inside toys !

Are amiibo useful for online gaming or are they totally unuseful ?

 

[NWPlayer123]

Well, with amiiqo (the "q" is a reversed "b", have you ever noticed it ) everyone can have a full load of virtual toys...
But with socram888 service it will be fun to see how data is stored inside toys !

Using @golden45's Cafiine dump I dumped the NFP backup loaded in Splatoon, which contains the raw decrypted data now (I know since it's the same format as the stuff in @socram8888's thread)

 

[asper]

Using @golden45's Cafiine dump I dumped the NFP backup loaded in Splatoon, which contains the raw decrypted data now (I know since it's the same format as the stuff in @socram8888's thread)

What's an "NFP" backup ? You mean NFC ? Can you tell us where in memory the decrypted dump is stored ?

Anyway if you change the data in memory then the game will write them re-encrypted for you ! Great finding man !!!!

 

[Rubyheart]

NFP was the code name for the amiibos. Nintendo Figurine Platform.

 

[NWPlayer123]

NFP was the code name for the amiibos. Nintendo Figurine Platform.

Yes, and that's also what the library's called. The Wii U has like 3 different libraries, a very low level NFC library, a higher level NTAG library, and then their specialized nn_nfp (Nintendo Network Nintendo Figurine Platform) library that needs C++. I haven't looked to see where it's loaded yet.

 

[asper]

Yes, and that's also what the library's called. The Wii U has like 3 different libraries, a very low level NFC library, a higher level NTAG library, and then their specialized nn_nfp (Nintendo Network Nintendo Figurine Platform) library that needs C++. I haven't looked to see where it's loaded yet.

So there is a file called nfp_backup.dat somewhere in memory during the game... really good finding man !

 

[socram8888]

Well, with amiiqo (the "q" is a reversed "b", have you ever noticed it ) everyone can have a full load of virtual toys...
But with socram888 service it will be fun to see how data is stored inside toys !

Are amiibo useful for online gaming or are they totally unuseful ?

Actually they would be even more suitable, given you could use them as simple keys and store data on a remote server, protected from cheating and replay attacks, and without using the scarce tag memory, which would mean you could use them with several games also. You would need permanent internet connection to use these amiibos, though.

So there is a file called nfp_backup.dat somewhere in memory during the game... really good finding man !

I can't speak for the Wii U, but on 3DS that file is stored on NAND, not on RAM, so it'll be there when not playing too.

 

[asper]

Actually they would be even more suitable, given you could use them as simple keys and store data on a remote server, protected from cheating and replay attacks, and without using the scarce tag memory, which would mean you could use them with several games also. You would need permanent internet connection to use these amiibos, though.

A kind of "virtual Amiibo" ! Cool ! Even if spoofing the simple UID/key will make a real-time perfect clone without needing to know the algos... so this will not be a great idea at last... anyway this is a new world to explore !

 

[pizzatime]

Amiibo NFC keygen released on Reboot: https://www.reboot.ms/forum/threads/amiibo-nfc-write-key-generator.632/
Knowing the key allow users to write back data to Amiibos without using WiiU and 3DS to do it.

 

[asper]

Amiibo NFC keygen released on Reboot: https://www.reboot.ms/forum/threads/amiibo-nfc-write-key-generator.632/
Knowing the key allow users to write back data to Amiibos without using WiiU and 3DS to do it.

...but data cannot be modified if you cannot decrypt/encrypt back them... you can copy back a previously dumped amiibo but I am not sure the game is not able to recognize it as "bad"... did someone test that ?