Hacking [Idea/Question] Possibility of using Mii Amiibos to launch payload.

[NitroCipher]

I was creating a Mii on my Switch today, and I noticed that you can copy a Mii over from an Amiibo.

Could you create a fake Mii Amiibo (using a nfc tag), that overflows executing a payload? I am not quite sure if this would work at all, or if it is even slightly feasible. I am a novice to the whole console hacking scene, so sorry if this isn't useful.

 

[SANIC]

I was creating a Mii on my Switch today, and I noticed that you can copy a Mii over from an Amiibo.

Could you create a fake Mii Amiibo (using a nfc tag), that overflows executing a payload? I am not quite sure if this would work at all, or if it is even slightly feasible. I am a novice to the whole console hacking scene, so sorry if this isn't useful.

Except that no payloads exist

 

[Somebody Whoisbored]

Except that no payloads exist

Well no shit. He is asking if it's possible to make one.

 

[itsjch]

Maybe like if someone made one and injected via blank NFC or amiiqo that would be great but lets keep dreaming.

 

[badpix11]

The Amiibo structure has a fix size/length, so beside no payload exists there is no overflow either.

For more information about the structure:
https://3dbrew.org/wiki/Amiibo

 

[Seelbreaker]

The Amiibo structure has a fix size/length, so beside no payload exists there is no overflow either.

For more information about the structure:
https://3dbrew.org/wiki/Amiibo

sooo...
as long as the size/lenght are somehow get spoofed you could try to load code trough Games which reads Amiibo-Data like Breath of the Wild - IF Games like Breath of the Wild even allow running Code from that amiibos?

 

[TiMeBoMb4u2]

Well... At the moment, the only amiibo I'm thinking this may be a possibility with is Wolf Link, in Breath of the Wild. Since the game reads in the Heart Container data from the amiibo, and not just the amiibo ID, someone might be able to reverse-engineer how this Heart Container data is handled in memory. I say this very loosely, since I can't recall hearing of any amiibo attack vectors in the past (I'd like someone to correct me on this, though).

 

[urherenow]

504 bytes. Not kilobytes. BYTES.

Not no, but hell no.

 

[migles]

The Amiibo structure has a fix size/length, so beside no payload exists there is no overflow either.

For more information about the structure:
https://3dbrew.org/wiki/Amiibo

INb4, hey newbie here!!! couldn't couldn't just just....
couldn't you just stick 2 amibbo fake cards taped togheter to create extra memory so could overflow????

 

[Seelbreaker]

Well... At the moment, the only amiibo I'm thinking this may be a possibility with is Wolf Link, in Breath of the Wild. Since the game reads in the Heart Container data from the amiibo, and not just the amiibo ID, someone might be able to reverse-engineer how this Heart Container data is handled in memory. I say this very loosely, since I can't recall hearing of any amiibo attack vectors in the past (I'd like someone to correct me on this, though).

And this part seems to be bugged afair?

i played TP but never got all heart pieces there and tried the dark cave of shadows with... i dunno 10? Hearts and didn't even finished and my Wolf Link in BotW has 20 Heart Pieces...

 

[DeadlyFoez]

INb4, hey newbie here!!! couldn't couldn't just just....
couldn't you just stick 2 amibbo fake cards taped togheter to create extra memory so could overflow????

Even better, if you tape a 3.5" floppy disk to it then you will get even more data through.

 

[TheDarkGreninja]

Yeah, 504 bytes is just a great size for a payload, yep /s

 

[shinyquagsire23]

Even if there were an overflow, ASLR makes this kind of overflow not viable because you'd need an address leak (ie data coming out and incorrectly) for it to possibly work. Generally only doable using something like JavaScript where it can leak addresses and craft ROP on the console itself based on the leaks.