Hacking DIY amiibo cards

[rena2019]

Then it's clear why decrypting by tool never works
From 2010 to 2011 Germany gave some NFC readers/writers with linux drivers away for free (intrtoduction of NFC-ID-Card), maybe those readers will work on @Supercool330 tool too. SCM SCL011.

The nPA BSI version of the SCL011 reader only supports Mifare Classic, Ultralight and DESFire. No NTag21x support.

 

[dibas]

The nPA BSI version of the SCL011 reader only supports Mifare Classic, Ultralight and DESFire. No NTag21x support.

I successfully dumped an amiibo with one of those though. It should be possible to send custom commands, too, but I haven't really looked into writing data yet, although it should likely work finely once we know what the missing piece is.

 

[Julizi]

The nPA BSI version of the SCL011 reader only supports Mifare Classic, Ultralight and DESFire. No NTag21x support.

Hmmm... There is an entry on the SCM-Website saying that those readers support NFC Forum Tags.

 

[Supercool330]

The SCL011 can definitely interact with an NTag (as it can interact with any type 2 tag), I'm just not sure if the open source library I'm using supports it, or if any open source library supports it for that matter. It isn't listed on the support list for either nfcpy or libnfc. It is worth giving it a try though as other SCM readers are supported.

 

[dibas]

The SCL011's drivers integrate it into the pc/sc API, so I'm just using a .NET wrapper around that API to access it. Most card readers should be supported that way. I'll try nfcpy sometime tomorrow and report back.

 

[rena2019]

The SCL011 can definitely interact with an NTag (as it can interact with any type 2 tag), I'm just not sure if the open source library I'm using supports it, or if any open source library supports it for that matter. It isn't listed on the support list for either nfcpy or libnfc. It is worth giving it a try though as other SCM readers are supported.

I only tried the SCL011 under Windows and not even an ATR works with an amiibo. Maybe libnfc can directly talk to the PN512 inside the reader without the firmware?

The other nPA reader SDI011 (that also supports contact cards) has a better firmware because it works with NTag215 tags

 

[Supercool330]

I figured it out. I'll post the working code later tonight.

 

[TotalInsanity4]

I figured it out. I'll post the working code later tonight.

Sweeeeeeeeeeeeeeeeeeeet you go man

 

[Supercool330]

Cool, I have some code working, and I was able to create a clone. Once I get it cleaned up a bit, I'll post it.

 

[elmoemo]

Anyone try anything like this with skylanders, infinity or dimensions?

 

[Pecrow]

Cool, I have some code working, and I was able to create a clone. Once I get it cleaned up a bit, I'll post it.

omg omg omg hype hype hype

 

[jrk190]

Now package it as an android app and profit. NFC on phone to read and write!

 

[Pecrow]

Now package it as an android app and profit. NFC on phone to read and write!

Imagine if everyone who made homebrews and hacks possible charged for their work. not that I dont think they do have the right to do so, but I regards to this topic 15$ per amiibo to unlock launch day DLC is just bad...

 

[jrk190]

Imagine if everyone who made homebrews and hacks possible charged for their work. not that I dont think they do have the right to do so, but I regards to this topic 15$ per amiibo to unlock launch day DLC is just bad...

Well, I mean he could do a free version with a pay to unlock special or beta features, or just donate. Or adfree. But android app would rock, either way.

I thought of it from more of an android standpoint vs homebrew. if smea charged for hax I'd be so poor.

 

[Pecrow]

Well, I mean he could do a free version with a pay to unlock special or beta features, or just donate. Or adfree. But android app would rock, either way.

I thought of it from more of an android standpoint vs homebrew. if smea charged for hax I'd be so poor.

Actually I would be okay with a donation in exchange for android app
--edit--
A free-will donation sounds better then a forced pay

either way, this is so exiting I cant wait for this to be ready.. I want to finally play games with out having to buy an amiibo

 

[Supercool330]

I have an android app that I'm working on, but I'm not sure I'll ever finish it (UI development is frustrating...). Even If I do I probably won't release it on the app store (I'll put the code up somewhere), and if I do I definitely wont charge for it.

 

[Pecrow]

I have an android app that I'm working on, but I'm not sure I'll ever finish it (UI development is frustrating...). Even If I do I probably won't release it on the app store (I'll put the code up somewhere), and if I do I definitely wont charge for it.

To be honest if it works I dont think people would mind if it looks like windows 3.5

 

[dkabot]

I have an android app that I'm working on, but I'm not sure I'll ever finish it (UI development is frustrating...). Even If I do I probably won't release it on the app store (I'll put the code up somewhere), and if I do I definitely wont charge for it.

To be honest if it works I dont think people would mind if it looks like windows 3.5

Aye, I wouldn't care if it was ugly as balls and an attached apk for manual install, so long as it got the job done.
It's not something people need more than once (per tag) anyway.

 

[fiveighteen]

I have an android app that I'm working on, but I'm not sure I'll ever finish it (UI development is frustrating...). Even If I do I probably won't release it on the app store (I'll put the code up somewhere), and if I do I definitely wont charge for it.

Yeah I don't think that would be too well-received in the Google Play Store. Congrats on getting it to work and for having the patience and dedication to figure it out!

If you get another minute to explain, I'm curious which part it was that was the final piece? Guessing that you finally got the right combination figured out? >

I just came to a realization. I was thinking about different sections of memory that could be hashed with the derived per amiibo hmac key, and I realized that you can't actually use that key since part of the seed is the write counter from the amiibo. However, the write counter isn't used with the "locked secret" keyset as the magic is 16 bytes long. This also totally explains why there are two sets of keys, the "unfixed infos" is used for the unfixed parts of the amiibo that can change, and the "locked secret" is used for the locked parts that can only be written once. This also explains why none of my hashing turned up any results; I was using the wrong keyset. I suspect we need to build a seed using the "locked secret" keyset, and then either hash it with the "locked secret" hmac key, take the first 32 bytes from the drbg, or generate a key with the drbg and decrypt/hash something. Regardless, the "locked secret" seed will still use the portion of the amiibo at 0x60, so almost certainly the target block of memory is 0x34-0x54. We just need to try various things until we get something that matches.

 

[TotalInsanity4]

I have an android app that I'm working on, but I'm not sure I'll ever finish it (UI development is frustrating...). Even If I do I probably won't release it on the app store (I'll put the code up somewhere), and if I do I definitely wont charge for it.

If you're stuck in the UI you could open-source it and post a thread in the mobile technology subforum