Hacking Use modified NFC to execute arbitrary code?

rvnx

Member
OP
Newcomer
Joined
Mar 26, 2015
Messages
17
Trophies
0
Age
30
XP
94
Country
Gambia, The
Hey guys!

I've recently bought the N3DS. It was a tough choice, but I needed a handheld to keep me entertained on my way to work. (My phone just drains way too much.)

Anyway, I've been using some flashcards on my old DSi, so I went looking around how the current state of the 3DS is in this compartment. It seems to have progressed quite a lot since I last saw something about using a flashcard on the 3DS about a year ago. Anyway, a friend of mine, we were playing SSMB, showed me one of those Amiibos. I found the concept pretty interesting and read up on them. They use NFC to read/write data from the Amiibo itself to trigger specific events in games, or even save data on them to be used on other hardware without loss of data.

So I've been thinking. It's possible to modify/program custom NFC tags that can be used to, let's say, trigger the WiFi on your phone for example. And I was wondering if it was possible to -theoretically- execute your own code using a modified Amiibo (or an NFC-Tag with modified data on it) to bypass some stuff related to loading flashcards or CFW?
It would obviously require some reverse engineering on what data the Amiibo tells the system, and what exactly it triggers, but it should be possible, right?

What are your opinions on this matter?
 

vingt-2

Well-Known Member
Member
Joined
Jan 30, 2015
Messages
112
Trophies
0
Age
31
XP
108
Country
Canada
Like any I/O options a device can use, it will depend on the level of security and checks implemented by the application programmer when handling communications via NFC.
 

Maximilious

Whistles a familiar tune
Member
Joined
Nov 21, 2014
Messages
2,571
Trophies
1
XP
1,855
Country
United States
That would be interesting. You can manage your Amiibo from the Home Settings menu so it would be fairly easy to execute. GW or any other flashcart designer could sell an NFC chip with USB input for file transfer for any updates they may need. Cool concept... so rvnx, GET CRACKIN! :)
 

aenoch

Well-Known Member
Member
Joined
Feb 23, 2015
Messages
748
Trophies
0
Age
35
Location
Ludington, Michigan
XP
330
Country
United States
lol. A gateway Amiibo...I wonder what such a monstrosity would look like. :P

I wouldn't put it past them to make one if they find an exploit that uses NFC as the entry point. A perfect excuse for them to make more money. :P
It would sweet if they used the Dragon logo. but then it would be cheaply made. " how did you hack your 3ds. With this bad ass Dragon. Right here" You could probable use your phone nfc. So it would be point less for them to sell
 

jrebey

Well-Known Member
Member
Joined
Mar 12, 2015
Messages
116
Trophies
0
Age
45
XP
143
Country
United States
There are buttons on the 3ds! If I push one I should be able to run arbitrary code, right? The secret has been in the buttons all along! Someone should make this happen. But not me because reasons.


Well... technically it's possible to glitch a game using the buttons and load arbitrary code.

As far as NFC goes, I'm pretty sure the NFC stack in the 3DS is meant solely for Amiibo. Amiibo data is encrypted. It's unlikely that the 3DS would accept arbitrary NFC data that isn't encrypted so the chances of exploiting a buffer overflow or something are pretty small. Unless of course someone gets their hands on the keys :)
 

jrebey

Well-Known Member
Member
Joined
Mar 12, 2015
Messages
116
Trophies
0
Age
45
XP
143
Country
United States
It would sweet if they used the Dragon logo. but then it would be cheaply made. " how did you hack your 3ds. With this bad ass Dragon. Right here" You could probable use your phone nfc. So it would be point less for them to sell


Not all phone NFC chipsets can be placed into tag mode which is required for the 3DS to read it.
 

Apache Thunder

I have cameras in your head!
Member
Joined
Oct 7, 2007
Messages
4,478
Trophies
3
Age
36
Location
Levelland, Texas
Website
www.mariopc.co.nr
XP
6,932
Country
United States
Amiibo encryption means nothing if you write to it using an exploited system. ;)

Altering Amiibos using a smartphone would be where the encryption would get in the way. But assuming you have enough control over the n3DS you can write a payload to the Amiibo and just have the n3DS do the encryption for you instead of trying to crack the encryption. This isn't much different then using the 3DS to decrypt it's own data like generating xorpads and decrypting roms. Amiibos would not be immune to this.


Gateway can use pre-exploited systems to write to Amiibos and then sell those Amiibos as well as provide a way for n3DS users on 9.2 or older fw to write a payload to the Amiibo themselves so they can use it once they update. That's how this would work in theory anyway.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
  • Sonic Angel Knight @ Sonic Angel Knight:
    Catboy back in chat. :ninja:
  • Sonic Angel Knight @ Sonic Angel Knight:
    Don't forget to pet it for good luck
  • K3Nv2 @ K3Nv2:
    That cat bites
    +1
  • Psionic Roshambo @ Psionic Roshambo:
    Hmmm yes she does
  • Psionic Roshambo @ Psionic Roshambo:
    Float like a butterfly burns when I pee lol
    +1
  • BigOnYa @ BigOnYa:
    So does that mean your date was not good? It burns now?
    +1
  • K3Nv2 @ K3Nv2:
    Got two new stds in one night
    +1
  • BigOnYa @ BigOnYa:
    Giggity
    +1
  • The Catboy @ The Catboy:
    I don't bite! Minus the times when I did bite
  • The Catboy @ The Catboy:
    Like 5 minutes ago
  • K3Nv2 @ K3Nv2:
    Billie needs her lunch
  • K3Nv2 @ K3Nv2:
    Ffs papa brought back the cheeseburger pizza it's like the only decent pie they had since the 80s
  • BigOnYa @ BigOnYa:
    I'm not a fan of papa johns, but that does sound good. We hardly order out pizza, I like making my own, but when we do its donatoes
  • K3Nv2 @ K3Nv2:
    I get them like once every two months anymore
  • K3Nv2 @ K3Nv2:
    Just because it's half a mile from where I live
  • BigOnYa @ BigOnYa:
    Request next time you order, that Shaq deliver it to you
  • K3Nv2 @ K3Nv2:
    I want him to buy me a chain also
  • K3Nv2 @ K3Nv2:
    Open it right next to the one we have
    +1
  • BakerMan @ BakerMan:
    guys should i make a new thread and just count the amount of posts until kyle, luke or leo joins the thread for fun?
  • BakerMan @ BakerMan:
    kyle's fine, just waiting for that wario joke

    luke and leo though, they yap until the thread's enjoyability is about halved
  • K3Nv2 @ K3Nv2:
    Leo is Luke's alterego when he gets hard
  • BigOnYa @ BigOnYa:
    Luke is gone, he got banned. And I'm surprised Leo hasn't yet
  • K3Nv2 @ K3Nv2:
    Subway was actually pretty decent tonight
  • BigOnYa @ BigOnYa:
    Wut you get, a seafood and psi salad sub
  • K3Nv2 @ K3Nv2:
    Psi had my footlong meatball special
    +1
    K3Nv2 @ K3Nv2: Psi had my footlong meatball special +1