Hacking DIY amiibo cards

[Deleted User]

Ah
I've fired off an email to amiitool's creator to get an API key anyways.
@_Tim_ should release his source code (I can put it on my git server if need be) so that people can work on porting it to Android and other boards than the one he made it for.

 

[Supercool330]

It would be really nice to find an inexpensive board that can emulate an NTAG215 so that we could actually reuse it (ideally based on open hardware).

It looks like you might be able to jank something together with a PN532 board and libnfc, but you have to do this weird trick with intercepting the anti-collision requests, which screws up the timing, so the Wii U might not read it.

It should definitely be possible with a proxmark3, but they are like $200+, so that isn't really practical.

It might also be possible with an EmuTAG, but out of the box it only supports 16 pages, and only 200 bytes of RAM period. It might be possible to dynamically load data from the 4k of flash memory, but that might be too slow. Plus, it is closed hardware with no real documentation, which again sort of defeats the point.

Edit: Just realized that AVR micro-controllers don't allow writing to the program space, so the EmuTAG idea is a bust.

 

[duffmmann]

This is cool, just a shame you need to purchase NTAG215 tags though. I have an amiiqo, and it works great, it'd just be nice to be able to quickly pull up the amiibo I want to use instead of having to cycle through each amiibo one at a time to get to the specific amiibo you're looking for, given that I have about 65 or so amiibo in my amiiqo, it can sometimes take quite a while to get to the amiibo you want. With Amiibo cards like these, you can quickly locate the amiibo you want to use and instantly pull it up. It's just too bad, it's such a process to complete and it isn't something you can do for free either. So as much as I'd like to do this, it just doesn't make sense from a financial standpoint especially since I have a fully functioning Amiiqo that can get the same job done, albeit sometime taking a long time to get to the amiibo you want to use.

 

[Deleted User]

Plus, unless you go the legal route, you have to illegally download the BINs.

 

[Deleted120957125]

e

 

[Deleted User]

If a device such as an amiiqo exists, why does it not change the UID? Surely that may not change?
Also, Tim, even though it's not finished, you should release the software, and what offset is the UID at

 

[Kingfish4200]

Tim, even though it's not finished you should release the software

Lol.. I see the chances of that happening being zero to nada

 

[Deleted User]

No, he's said he'll release it, but it's for a specific board rn.
All we have to do is find how to write to an NTAG215. That's it.

 

[Tesa]

No, he's said he'll release it, but it's for a specific board rn.
All we have to do is find how to write to an NTAG215. That's it.

I don't think he ever did.
You're also jumping to conclusions here: Even if you can write to an NTAG215 you still don't have a way to encrypt the files again.

You could, if socram8888 would release the api key but I highly doubt that, same goes for _Tim_ releasing his software since he could get into legal trouble.

Even if you would get all the software it would most likely be still cheaper for most users to just either buy the amiibos or get something like the n^2. (except if someone would develop an andoid app for that)

 

[aracom]

Same goes for _Tim_ releasing his software since he could get into legal trouble here.

Why should he? He wrote something that writes a special bin file via hardware to an nfc tag. It's not something Nintendo has the right to block.

 

[Deleted User]

@Tesa wrong:
You can get the keys for encryption from a pastebin up earlier and use that as a keyfile for amiitools, I know this. And _Tim_ made a BIN flasher, not an amiibo flasher. it literally justs reads the hex values and writes them to the NFC tag, nothing more, he cannot be C&D'd. I have an API key for amiitools, all it does is let me encrypt it on his server without me having the keys.

Someone can make a BIN flasher for Android and nintendo have NO RIGHT doing anything. Amiitools cannot be taken down as he's not publically allowing encryption, you have to find the keys yourself.

 

[Tesa]

Why should he? He wrote something that writes a special bin file via hardware to an nfc tag. It's not something Nintendo has the right to block.

I'm not talking about the software he uses to write the data.

You need to decrypt, edit and encrypt the bin file before you can actually write it to the tag. We have a public service to decrypt them but no way to encrypt them after editing.

@Tesa wrong:
You can get the keys for encryption from a pastebin up earlier and use that as a keyfile for amiitools, I know this. And _Tim_ made a BIN flasher, not an amiibo flasher. it literally justs reads the hex values and writes them to the NFC tag, nothing more, he cannot be C&D'd. I have an API key for amiitools, all it does is let me encrypt it on his server without me having the keys.

As already stated, I was talking about his software to encrypt the files. If you got the api key: good for you! You still need to change the UID in the file itself to your ntag.
But also, he most likely has a custom board to write the data on the tags.

I'm sorry if I sound rude or anything but I just want to underline the fact that this isn't just as easy as _Tim_ made it look like (for him it probably is) -> "press 5 buttons and I have a batch of amiibo tags". So what I'm saying is: Don't get your hopes up too high.

 

[EpicLPer]

DIY amiibo cards... created using blank NTAG215 tags and a little bit of dark magic

You need:
- a blank NTAG215 tag sticker (Shop NFC, AliExpress, ...)
- an amiibo dump (dump your own amiibo, download it, ...)
- a way to decrypt/encrypt amiibo dumps (amiibo decryption service, amiitool, ...)
- NFC reader/writer hardware (USB NFC reader/writer, Android smartphone with NFC, ...)
- compatible software to write an amiibo dump to a blank NTAG215 tag (I could not find any so wrote my own)
- a hex editor (HxD, UltraEdit, ...)
- a picture of the amiibo (download it)
- a printer (printer at home, printer at work, photo kiosk, ...)
- a ruler and a cutter knife

Steps:
- decrypt amiibo dump
- use hex editor to change UID in amiibo dump to UID of blank NTAG215 tag
- encrypt amiibo dump
- write amiibo dump to blank NTAG215 tag
- print amiibo picture and cut it out
- put NTAG215 tag sticker on the back of amiibo picture

Out of curiosity, would an Android phone with NFC work to read, decrypt and write those? Someone should make an app for that ;P

 

[Deleted User]

No he doesn't.
I've spoken to him - he uses an Adafruit board to flash it. And IK what to do thanks. Amiitool only requires a key that YOU CAN GET OFF A PASTEBIN LINK FROM SOMEONE IN THIS THREAD.

--------------------- MERGED ---------------------------

Out of curiosity, would an Android phone with NFC work to read, decrypt and write those? Someone should make an app for that ;P

Someone could - They could in theory run the bash script on the phone while doing it all. Reading to dump is done by the amiiqo app rn, and then people can use amiitool to decrypt, edit UID, and if they get the publicly available key, they can encrypt. Then use a certain method to flash to the tag and done.

 

[fraret]

No he doesn't.
I've spoken to him - he uses an Adafruit board to flash it. And IK what to do thanks. Amiitool only requires a key that YOU CAN GET OFF A PASTEBIN LINK FROM SOMEONE IN THIS THREAD.

How do we use the keys? I don't know how a key file for amiitool has to be.

 

[Tesa]

Out of curiosity, would an Android phone with NFC work to read, decrypt and write those? Someone should make an app for that ;P

In theory, yes. But it's questionable if someone will actually do all of this.
About a year ago someone developed a tool which could (at least according to him) even emulate amiibos (He documented how he did it). But pulled everything again right before releasing it.

 

[Deleted User]

get the key (they're in hex) then put them into a bin so that they are not hex.

--------------------- MERGED ---------------------------

In theory, yes. But it's questionable if someone will actually do all of this.
About a year ago someone developed a tool which could (at least according to him) even emulate amiibos (He documented how he did it). But pulled everything again right before releasing it.

We can do it. We just need to find a way of writing to the thing via an Android app, then we're fine.

 

[fraret]

get the key (they're in hex) then put them into a bin so that they are not hex.

There are multiple keys.

 

[Deleted User]

Yes. Try each one , or try all together. (Only set 1!!!)
To decrypt you can just use amiisrv.sh

 

[dkabot]

Okay, so we have keys (from pastebin), dumps (from there), a tool to de/encrypt so we can hexedit...

So the only missing piece is the tool to write?