Hardware amiibo decryption service

[socram8888]

Before anything and going any further I should explain some stuff:

• No, this won't let you change the amiibo you have. You can't alter the character ID using this.
• No, you aren't going to find an exploit on the 3DS system using this. Everything has a fixed size and you aren't going to be able to make a buffer overflow.
• No, this won't calculate the NFC write key either, so forget about writing old dumps and replaying data.
• No, I won't be releasing Nintendo's private keys, so don't even bother to ask for them.

With that explained, this script will let you decrypt and encrypt binary amiibo dumps (XML or plain text won't work). Everything is sent to a secure server that has the keys, and you get the result on your computer.

http://www.socram.ovh/amiibo/​

Encrypted and decrypted Mario amiibo:

 

[_Tim_]

0D1C771D8C836CD010CB06434ACCBA2A5532F7F9

 

[dark_samus3]

0D1C771D8C836CD010CB06434ACCBA2A5532F7F9

You got that key by comparing the decrypted and encrypted data didn't you?

 

[cearp]

http://gbatemp.net/threads/release-amiibo-api-encryption-key-wii-u-3ds.407174/
so now we can decrypt and reencrypt amiibo, right?

 

[Thunder Hawk]

http://gbatemp.net/threads/release-amiibo-api-encryption-key-wii-u-3ds.407174/
so now we can decrypt and reencrypt amiibo, right?

I see you're not the only one who remembered this thread... (or did you follow my link?)

 

[cearp]

I see you're not the only one who remembered this thread... (or did you follow my link?)

no i didn't see your link!

 

[socram8888]

You got that key by comparing the decrypted and encrypted data didn't you?

It's AES. You can't get the key that way.

http://gbatemp.net/threads/release-amiibo-api-encryption-key-wii-u-3ds.407174/
so now we can decrypt and reencrypt amiibo, right?

I've just revoked the key.

If anybody wants to encrypt back their amiibos they just have to ask me for a private key, either here or in mail

 

[cearp]

I've just revoked the key.

If anybody wants to encrypt back their amiibos they just have to ask me for a private key, either here or in mail

why did you do that? (just curious)
thanks for the service though.

 

[socram8888]

why did you do that? (just curious)
thanks for the service though.

I want to be able to know who's using the service to encrypt stuff.

As I already mentioned on my Twitter on the matter, it's possible to create valid dumps for blank NTAG215s, so it could be possible to manufacture counterfeit amiibos. As for privacy reasons I don't want to register IP or tag UIDs, my only way to detect these is by looking every now and then on the text log and checking if somebody have encrypted a massive amount of tags. If a key leaks this would fail, as everybody would start using a single key.

Again, if anybody needs one, just send me a PM or an email.

 

[piratesephiroth]

is this relevant?

*snip*

 

[socram8888]

is this relevant?

****

Yep. Most of those keys are the ones needed to decrypt amiibos.

By the way, given using a shell app and a hacked protocol is a bit too complex for users or programmers, I've been reimplementing the amiitool application in PHP, and made this: http://84.123.14.123/amiibo/test.html (note this is a test server - will be moved to the VPS, so don't rely on this address)

CORS allow cross-origin request, so coders would be able to use this in their own website or applications by means of XMLHttpRequest.

 

[Myria]

Lulz, since your server won't be necessary once someone leaks the AES key scrambler algorithm.

 

[socram8888]

Lulz, since your server won't be necessary once someone leaks the AES key scrambler algorithm.

And this proves most of you have no idea on how the amiibo encryption works. Or how to read a presentation, for that matter.

With all the documentation out there you could easily have your own keys, without needing the keyscrambler algorithm.

 

[socram8888]

API KEY CHECK HAS BEEN REMOVED (on the HTTP version)

Instead, it will only allow you to recrypt a tag iff it has been decrypted at least once in the past. This will allow you to cheat and to what the hell you want to, and prevent people from creating new tags.

 

[Banzai]

Hello,

if I want to decrypt a dump, change the UID and re-encrypt it, I get the message "Dump musthave been decrypted using this service before being able to recrypt it" what could be this?

greeting
Banzai

 

[piratesephiroth]

Hello,

if I want to decrypt a dump, change the UID and re-encrypt it, I get the message "Dump musthave been decrypted using this service before being able to recrypt it" what could be this?

greeting
Banzai

It's intentional, to prevent amiibo counterfeiting

 

[TheHomesk1llet]

watches silently

 

[nitrostemp]

website is dead... any chance of rehosting?

 

[The Real Jdbye]

website is dead... any chance of rehosting?

Is it really needed anymore? You can now do the decrypting/encrypting offline, with tools such as TagMo.

 

[nitrostemp]

and you dont have to mess with the hex of the amiibo?