Homebrew [Help] Getting the amiibo identification block

[Slimfr01]

Hi,

I developping a small amiibo application for 3ds.
Everything go fine to communicate with the NFC reader, reading appdata amiibo settings and config ...
but despite all my search and tests i don't found a way to get the identification block.

Unlucky, it's the only thing that i need for this application to identify the scanned amiibo.

I knew that only few developpers work on the NFC service but is there a way to get this block ?

Thank for your help and sorry for my english.

 

[N3evin]

Hi,

I developping a small amiibo application for 3ds.
Everything go fine to communicate with the NFC reader, reading appdata amiibo settings and config ...
but despite all my search and tests i don't found a way to get the identification block.

Unlucky, it's the only thing that i need for this application to identify the scanned amiibo.

I knew that only few developpers work on the NFC service but is there a way to get this block ?

Thank for your help and sorry for my english.

Look at page 21 and 22 consist of 8bytes with both of them combined. (0x54 to 0x5B)

Look at info tab in here:
https://docs.google.com/spreadsheets/d/19E7pMhKN6x583uB6bWVBeaTMyBPtEAC-Bk59Y6cfgxA/edit

 

[Slimfr01]

Look at page 21 and 22 consist of 8bytes with both of them combined. (0x54 to 0x5B)

Look at info tab in here:
https://docs.google.com/spreadsheets/d/19E7pMhKN6x583uB6bWVBeaTMyBPtEAC-Bk59Y6cfgxA/edit

This work with the dump of all data from the amiibo ( with a NFC reader for PC and/or android )
NFC reader for 3ds ( at least with devkitpro ) only read specific data with specific command ( for example with a command you get the config with mii's owner, amiibo's nickname, ... with an other you get the data saved by a game ... ).

So i need, with devkitpro and ctrulib, a way to get specifically this identification block or a way to dump any portion of data that work on both n3ds and o3ds with NFC reader.

 

[Deleted User]

You could try reverse engineering the development app for O3DS/N3DS (Nintendo SDK one)

 

[N3evin]

This work with the dump of all data from the amiibo ( with a NFC reader for PC and/or android )
NFC reader for 3ds ( at least with devkitpro ) only read specific data with specific command ( for example with a command you get the config with mii's owner, amiibo's nickname, ... with an other you get the data saved by a game ... ).

So i need, with devkitpro and ctrulib, a way to get specifically this identification block or a way to dump any portion of data that work on both n3ds and o3ds with NFC reader.

ah fair enough, did not researched on that, seems interesting.

 

[Deleted User]

Considering dev apps can let you write to the tags (for dev usage) it does, however, use the inbuilt encryption of the 3DS, so it must be able to send/receive raw NFC commands (maybe the SDK amiibo library could be ported?)

 

[Slimfr01]

maybe the SDK amiibo library could be ported?

Probably but i don't have the knowledge to do this.
Thanks for your help.

 

[Slimfr01]

So ... after some test i found the datas.
It was part of the unidentified datas of the NFC_amiiboConfig element from ctrulib.

typedef struct {
    u16 lastwritedate_year;
    u8 lastwritedate_month;
    u8 lastwritedate_day;
    u16 write_counter;
    u8 characterID[3];
    u8 serie;///ID of the serie
    u8 amiiboID;///ID shared by all exact same amiibo. Some amiibo are only distinguished by this one like regular SMB Series Mario and the gold one
    u16 type;/// Type of amiibo 0 = figure, 1 = card, 2 = Plush
    u8 val_xc;
    u8 pagex4_byte3;/// "This is byte[3] from NFC page[0x4]."
    u8 appdata_size;/// "NFC module writes hard-coded u8 value 0xD8 here. This is the size of the Amiibo AppData, apps can use this with the AppData R/W commands. ..."
    u8 zeros[0x31];/// "Unused / reserved: this is cleared by NFC module but never written after that."
} NFC_AmiiboConfig;

For those who want the edited file from ctrulib with correctly named characters data :
https://github.com/Slimfr01/ctrulib/blob/master/libctru/include/3ds/services/nfc.h

 

[hippy dave]

Good work. I'm guessing the NFC service doesn't have the ability to write a whole tag, for making your own fake amiibo?

 

[Deleted User]

No, it does, as previously mentioned, the dev apps can do it (and you can use an N3DS + NTFs to do it yourself)

 

[Slimfr01]

No, it does, as previously mentioned, the dev apps can do it (and you can use an N3DS + NTFs to do it yourself)

No dev service can only be used with a dev nfc reader and even with that identication data can only be write once. After that data are locked on the nfc tag so you can't edit amiibo where you want. ( without that third party nfc reader could edit the identification data and amiiqo will be useless )

 

[Deleted User]

No dev service can only be used with a dev nfc reader and even with that identication data can only be write once. After that data are locked on the nfc tag so you can't edit amiibo where you want. ( without that third party nfc reader could edit the identification data and amiiqo will be useless )

He said write a tag, not edit a tag which you can do. ALSO, bullshit: Nintendo Development say themselves to use a retail nfc reader with the dev PANDA to write stuff if you have the O3DS, as it's been asked before.
You can just do it with your phone too

 

[hippy dave]

Yeah I know about the identification data only being writeable once, and yeah I was talking about making a fake amiibo with a tag as people have been doing with android phones etc - but my phone doesn't have nfc
So if this is possible, a homebrew app for it would be very cool indeed.

 

[DocKlokMan]

No, it does, as previously mentioned, the dev apps can do it (and you can use an N3DS + NTFs to do it yourself)

The tags made with the dev apps aren't usable on retail systems, only dev systems. However, we should be able to at least dump Amiibo data using homebrew, not sure about writing it though.

 

[Deleted User]

The tags made with the dev apps aren't usable on retail systems, only dev systems. However, we should be able to at least dumb Amiibo data using homebrew, not sure about writing it though.

Because the internal encryption keys were dev sets. As previously stated, there's a writer that uses the N3DS. As retail systems can write with retail keys, you can do that perfectly fine

(Heck even Rycunt got it working)

 

[DocKlokMan]

Because the internal encryption keys were dev sets. As previously stated, there's a writer that uses the N3DS. As retail systems can write with retail keys, you can do that perfectly fine

(Heck even Rycunt got it working)

... Hmmm. I didn't consider it would make a difference based on if it were installed on a retail system or not, I just assumed the files that were written were different. I'll be checking this out with renewed vigor now.

 

[hippy dave]

As previously stated, there's a writer that uses the N3DS.

What's this called?

 

[N3evin]

Try looking into this.
https://github.com/Ordim3n/Smash-Amiibo-Cheat-Tool

 

[Slimfr01]

The tags made with the dev apps aren't usable on retail systems, only dev systems. However, we should be able to at least dumb Amiibo data using homebrew, not sure about writing it though.

Homebrew can at least do what retail game do : get info about amiibo and owner and write/read an appdata with a specific appid. For now we can't get the appid with a homebrew ( so we need to work with only a game or test every appid or let the user choose the good appid ).

I don't know if it's possible with dev service to dump everything because the nfc reader do his part on data treatment and send only what is needed. ( and dev only need to be able to choose identification block one time and to be able to read/write appdata like for retail game )

 

[Deleted User]

What's this called?

NTFWrite or similar, in the CTR_SDK