Hacking DIY amiibo cards

[Pecrow]

It's a few post above

Is it the amiitool link? I read over the readme info and stuff, but I think i'm a more noobish guy. Ill wait for a tutorial not sure how someone could write the bin directly to the blank tag.

 

[fiveighteen]

@HiddenRambler, congrats! My only question is what did you use to write to the NTAG? Was it the modified amiiwrite app?

 

[Deleted User]

One would use a modified program to do so.

 

[Pecrow]

Ah ok got it now

 

[dibas]

I just burned my first tag. Not sure what went wrong. @javiMaD, I followed what you did on page 12 and used your fork to de/encrypt the files. Wii U says "This might not be an amiibo blahblah". Any ideas except what's been mentioned in your guide? Are you writing with 0xA2 as Cmd? I also shouldn't need to authenticate as there's no PWD set, right?

 

[Julizi]

I would like to have those keys too. But I think it's more senseful to create a tutorial for all of us. ^^

 

[javiMaD]

I just burned my first tag. Not sure what went wrong. @javiMaD, I followed what you did on page 12 and used your fork to de/encrypt the files. Wii U says "This might not be an amiibo blahblah". Any ideas except what's been mentioned in your guide? Are you writing with 0xA2 as Cmd? I also shouldn't need to authenticate as there's no PWD set, right?

Is your new keyset ok?
MD5 45fd53569f5765eef9c337bd5172f937
SHA1 bbdbb49a917d14f7a997d327ba40d40c39e606ce

 

[dibas]

Is your new keyset ok?

It is, hashes match. Kind of out of ideas at the moment. What did you write the data with, if you don't mind me asking?

 

[Julizi]

Well, seems like I missed somethimg important!
Can someone clear what is meant by "new keyset". My "old keyset" is SHA-1: 125083246346D7FB76E198D759CF1167E503A662. What do I need for the "new keyset"?

 

[javiMaD]

It is, hashes match. Kind of out of ideas at the moment. What did you write the data with, if you don't mind me asking?

I use https://github.com/socram8888/ulread with a PN532 breakout board, first with locks removed (amiibo_base) and then full (amiibo_mod).

 

[HiddenRambler]

I modified the original amiitool much like @javiMaD did, and used to to generate an encrypted amiibo file which matched the UID of my blank tag.

After that i wrote a simple android app to write the file to the tag using a Nexus 5. The app it self is extremly simple you don't need any special commands other than whats already supported by android api. I just modified the code from the original guide android guide http://developer.android.com/guide/topics/connectivity/nfc/advanced-nfc.html

I'm working on a simple app to write the NfcTag, this combined with javiMaD's modified amiitool should be all thats needed to make blank tags, as long as you can find/build the key files.

As for the key files all the information you need are in the pastebin file posted a while ago(the link was deleted) but you could still find it if you search.

 

[Deleted User]

Can you plese send a BIN writing APK? (One that just writes the BIN, no amiitool)

 

[derthomas]

What Hardware do I Need besides The tags? Does a nfc Reader/Writer from aliexpress do The Trick?

 

[Celeryyy]

Haven't been following this too closely; does someone have a >5.0 modified version of AmiiWrite that works with external storage? Using root manager I got the amiibos.db out, edited some values, and was able to put a 200/200/200 Diddy Kong back on the figure.

I can use Git and recompile it with an external storage edit though if it'd be useful to anyone.

 

[FunThomas]

an app to write nfc tags bin files under android 4.4 would be very helpful

i would try but its nearly impossible to find any app that writes bin under android to 215 tags or under windows for using the acr122u writer

 

[rena2019]

Is your new keyset ok?
MD5 45fd53569f5765eef9c337bd5172f937
SHA1 bbdbb49a917d14f7a997d327ba40d40c39e606ce

what I'm doing wrong? I try to create the required key file since 1 hour. but checksum does not match. here are first 2 and last 2 columns of my dump:

ed 29...8a c0
75 6e...00 0e
db 4b...00 00
04 49...ae d4
ef 39...47 66
1d 16...c2 05
6c 6f...00 10
fd c8...74 c1
04 49...ae d4
ef 39...47 66

What's wrong with it?

 

[HiddenRambler]

what I'm doing wrong? I try to create the required key file since 1 hour. but checksum does not match. here are first 2 and last 2 columns of my dump:

ed 29...8a c0
75 6e...00 0e
db 4b...00 00
04 49...ae d4
ef 39...47 66
1d 16...c2 05
6c 6f...00 10
fd c8...74 c1
04 49...ae d4
ef 39...47 66

What's wrong with it?

File should start with 7F 75 28 instead of ed 29 ...

 

[rena2019]

File should start with 7F 75 28 instead of ed 29 ...

Really? I thought that it should start with uint8_t hmacKey[16] https://github.com/javimadgit/amiitool/blob/master/include/nfc3d/keygen.h and 7F 75 28 is the hardcoded type string "unfixed infos" I found @ pastbin

 

[HiddenRambler]

New thread created : http://gbatemp.net/threads/release-tagmo-tool-for-creating-editing-amiibos.431670/

Spoiler: Old Post

TagMo 2.1 released: http://gbatemp.net/threads/diy-amiibo-cards.406978/page-28#post-6043258

Spoiler

Edit: New version. read carefully

Spoiler: Old Post

Spoiler

This new version can automatically do all the encryption/decryption/uid calculation etc. as long as you provide the correct keys.

Use the menu to browse and load with the needed keys (only needed to be done once).

After that load a amiibo dump then use the "Write to tag (Auto)" option to write to a blank tag.

If you've already done the encryption/uidfix/encryption stuff using the amiitool then you can use the "Write to tag (Raw)" option.

The tool also lets you dump tag (amiibo) to a file.

The tool contains a copy of amiitool inside it to do all the hard work automagically.

New Version: https://drive.google.com/file/d/0BwV_DUnv_6kxYy0ycEdGeDFQeWM/view?usp=sharing

Source code: https://github.com/HiddenRambler/TagMo

Old post:

Spoiler

Attached is a small app which can write VALID tag file to a blank NTAG215 tag. **The file must already be correctly encrypted to match the new tags UID**. The app will auto calculate the write password.

Load the file using the menu. then select write from menu and then put the phone on the tag. try not to move the phone and be careful as there is virtually no error checking/recovery.

I think you can use the modified version of amiitoo by @javiMaD, but i haven't tested it.

It worked twice for me so far but it your mileage will probably vary.

This is really alpha quality stuff. No real error checking I have no idea what bad things it could do to your tags/phone/3ds. I will not be held responsible for any damage including but not limited to the event that Nintendo may send hitmen to kill you.

I will post the source code as soon as I can figure out which files might contain private data in a android project.

Thx again for all the people who posted details to make this possible.


Edit: Included source code.

 

[Deleted User]

Thank you so much! My only issue with @javiMaD 's amiitool is I can't find the correct keys for it, could you PM them me?

Time to start testing!