Hacking DIY amiibo cards

Pecrow

Well-Known Member
Member
Joined
Jun 23, 2015
Messages
1,137
Trophies
0
Age
33
XP
640
Country
United States
You do know a ntag216 is not interchangeable with a ntag215?
And you do know how many useable bytes are available in a ntag215?
So the answer should be obvious.
To be honest I do not know that information... Could you share so that I can file a claim with amazon and try to cancel my order then? :(
 

Bug_Checker_

Well-Known Member
Member
Joined
Jun 10, 2006
Messages
950
Trophies
0
XP
664
Country
United States
To be honest I do not know that information... Could you share so that I can file a claim with amazon and try to cancel my order then? :(
You MAY get a ntag215 BUT it will NOT have "888 useable bytes".

http://www.nxp.com/products/identif...144-504-888-bytes-user-memory:NTAG213_215_216

EEPROM
  • 180, 540 or 924 bytes organized in 45, 135 or 231 pages with 4 bytes per page
  • 144, 504 or 888 bytes freely available user Read/Write area (36, 126 or 222 pages)
  • 4 bytes initialized capability container with one time programmable access bits
  • Field programmable read-only locking function per page for the first 16 pages
  • Field programmable read-only locking function above the first 16 pages per double page for NTAG213 or per 16 pages for NTAG215 and NTAG216
  • Configurable password protection with optional limit of unsuccessful attempts
  • Anti-tearing support for capability container (CC) and lock bits
  • ECC supported originality check
  • Data retention time of 10 years
  • Write endurance 100,000 cycles
 
Last edited by Bug_Checker_,

Bug_Checker_

Well-Known Member
Member
Joined
Jun 10, 2006
Messages
950
Trophies
0
XP
664
Country
United States
Will it work for these amiibos thing tho? I dont know the size of the amiibo data
I am not this company so I do not know if they will send you a ntag215 or a ntag216.
If they send you a ntag215 it should work(but you will not have "888 useable bytes").
If they honor the claim of "888 useable bytes" then they must send you a ntag216(which will not (currently)work with amiibos).
 

Pecrow

Well-Known Member
Member
Joined
Jun 23, 2015
Messages
1,137
Trophies
0
Age
33
XP
640
Country
United States
I am not this company so I do not know if they will send you a ntag215 or a ntag216.
If they send you a ntag215 it should work(but you will not have "888 useable bytes").
If they honor the claim of "888 useable bytes" then they must send you a ntag216(which will not (currently)work with amiibos).
Thank you a lot for the information, I have contacted the seller regarding this query. I will update back when possible in case anyone else wants to get these. Thank you again for the info.
 
  • Like
Reactions: Bug_Checker_

TreyTrent

Well-Known Member
Newcomer
Joined
Oct 23, 2015
Messages
68
Trophies
0
Age
48
XP
71
Country
Canada
Is it possible to use the WiiU or 3DS to write these tags? I mean, the 3DS is pretty open these days and got the hardware I think. Would be some neat homebrew!
 
  • Like
Reactions: Pecrow

aracom

Well-Known Member
Member
Joined
Oct 1, 2015
Messages
476
Trophies
0
XP
363
Country
Gambia, The
@gudenaurock Like I said, we'll have to use either NTAG.rpl or NFC.rpl. NTAG doesn't seem to have as low level access as NFC has, so I think I'll go for NFC if I can get that to initialize by just using IDA to find out how it works.
 
  • Like
Reactions: Azel

Supercool330

Well-Known Member
Member
Joined
Sep 28, 2008
Messages
752
Trophies
1
XP
1,129
Country
United States
I updated the layout on the Wikitemp Amiibo page to document the entire layout. I'll add descriptions for each byte when I have some time. There is really only two things I haven't figured out. The first is what the data on page 23 is used for. This is the page immediately after the character data pages, and as far as I can tell it isn't really used for anything currently. This means that if we are doing something wrong on this page (which is locked) it is possible that this could be used to detect a fake. If people could post UIDs along with pages 21 through 23, that would be great. The second thing is exactly how the 0x20 byte block at page 24 is generated. You can use whatever values you want here and the tag seems to work fine, so my assumption is that it is random (which makes sense as it is essentially used as salt for the DRBG used to generate per amiibo keys). However, if it is a hash of something, this could again be used to detect a fake. In fact, generating a valid (but corrupt) Amiibo dump is super easy, you can just set every byte to random, and then write the 2 pages with the character data.

Will it work for these amiibos thing tho? I dont know the size of the amiibo data
Those are actually the tags I used, and the ones I got were definitely NTAG215s (the description was of course wrong).

You can only emulate NFC Forum Type 4 Tags (alias contactless smartcards) with Andoid HCE. amiibos are NFC Forum Type 2 Tags
Not entirely true. The hardware is actually capable of emulating NFC Type 2 Tags, and CM 9.1 through 10 something actually supported this on devices with NXP NFC chipsets. The problem is that the hardware doesn't allow you to set an arbitrary UID; the first byte is locked to a specific value (0x08) in order to differentiate the emulator from an actual tag. You can actually work around this by manually overriding the handling of the anti-collision commands, but this will almost certainly mess up the timings, and I'm not certain that the CM implementation would even allow you to do this. Furthermore, this would only work on devices with a very specific very old version of CM and a specific NFC chipset. It's possible that somebody could create VERY custom firmware for exactly this purpose, but it would be an exceedingly high amount of effort.
 
Last edited by Supercool330,

Pecrow

Well-Known Member
Member
Joined
Jun 23, 2015
Messages
1,137
Trophies
0
Age
33
XP
640
Country
United States

rena2019

Member
Newcomer
Joined
Dec 29, 2015
Messages
18
Trophies
0
Age
55
XP
60
Country
Gambia, The

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
    K3Nv2 @ K3Nv2: https://youtu.be/PRMX5mX-hvs?si=JdjNrndYJ7PelC7q