Hacking DIY amiibo cards

  • Thread starter Thread starter _Tim_
  • Start date Start date
  • Views Views 565,757
  • Replies Replies 825
  • Likes Likes 47
I haven't got my head around the final encrypting stage yet,
I thought SuperCool figured it out, did'nt he?
I'm not actually comfortable posting code to do this (don't want to get in trouble with anybody, and the previous code I posted is really just a python port of amiitool with some added nfc stuff). The missing piece however is in fact using the locked secret keys to generate another derived keyset, and then using the hmac key from that keyset to hash the last two pieces hashed for the key at 0x80 (0x00 to 0x08 and 0x54 to 0x80). I actually just guessed this, and it was essentially my first guess after I thought to use the locked secret keys. I'll let somebody else write up the final code and share it.
 
It's ok, but read this "An NFC tag can be rewritten an infinite number of times until it is locked or physically damaged..."
For clone an Amiibo you need to set the lock bits, then the locked areas can't be rewritten
Ok now it's clear
 
I thought SuperCool figured it out, did'nt he?

"The missing piece however is in fact using the locked secret keys to generate another derived keyset, and then using the hmac key from that keyset to hash the last two pieces hashed for the key at 0x80 (0x00 to 0x08 and 0x54 to 0x80)"

Unfortunately I don't really understand this, I have a kind of idea of what this means, but not enough to code anything.
 
Last edited by nurofen,
Last edited by Bug_Checker_,

Site & Scene News

Popular threads in this forum