Amiibo - Revision history

GaryOderNichts: Create table for nfc page 0x4

2022-09-21T10:47:23Z

Create table for nfc page 0x4

@@ Line 38: / Line 38: @@
 | 0x4
 | style="background: green" | Yes
-| Last 3-bytes here are used with the following HMAC where the size is 0x1DF-bytes. The u16 starting at byte1 is used for the first two bytes in the 0x40-byte input buffer for Amiibo [[Process_Services_PXI|crypto]] init. The first byte must be 0xA5. The remaining bytes are initially(before the Amiibo is written to) all-zero. Byte[2](maybe big-endian u16 starting at byte1?) here is incremented each time the Amiibo is written to.
+| Last 3-bytes here are used with the following HMAC where the size is 0x1DF-bytes. The u16 starting at byte1 is used for the first two bytes in the 0x40-byte input buffer for Amiibo [[Process_Services_PXI|crypto]] init.
 |-
 | 0x5
@@ Line 166: / Line 184: @@
 | 0x7
 | 0x1
-| Version
+| Format Version
 | Always 0x02
 |}

2022-08-31T16:32:13Z

Wii U's ntag.rpl calls this field "Format version"

2017-07-14T15:08:59Z

Structure of Amiibo Identification Block

← Older revision		Revision as of 19:08, 14 July 2017
Line 137:		Line 137:
	! Size		! Size
	! Description		! Description
			! Notes
	\|-		\|-
	\| 0x0		\| 0x0
	\| 0x2		\| 0x2
	\| Game & Character ID		\| Game & Character ID
			\| First 10 bits are the Game ID and last 6 bits are Character ID.
	\|-		\|-
	\| 0x2		\| 0x2
	\| 0x1		\| 0x1
	\| Character variant		\| Character variant
			\|
	\|-		\|-
	\| 0x3		\| 0x3
	\| 0x1		\| 0x1
	\| Amiibo Figure Type		\| Amiibo Figure Type
			\|
	\|-		\|-
	\| 0x4		\| 0x4
	\| 0x2		\| 0x2
	\| Amiibo Model Number		\| Amiibo Model Number
			\|
	\|-		\|-
	\| 0x6		\| 0x6
	\| ~~0x2~~		\| 0x1
	\| Amiibo Series		\| Amiibo Series
			\|
			\|-
			\| 0x7
			\| 0x1
			\| Unknown
			\| Always 0x02
	\|}		\|}

2016-11-07T22:09:42Z

Games using Amiibo AppData

← Older revision		Revision as of 01:09, 8 November 2016
Line 358:		Line 358:
	\| Starts with the process-name("MILLION"). The rest seems to be bitmasks maybe?		\| Starts with the process-name("MILLION"). The rest seems to be bitmasks maybe?
	\| No crash ever triggered via AppData fuzzing, when viewing "character cards"(just unlocks various cards).		\| No crash ever triggered via AppData fuzzing, when viewing "character cards"(just unlocks various cards).
			\|-
			\| The Legend of Zelda: Twilight Princess HD
			\| No
			\| Yes
			\| 0x1019C800
			\| Unknown.
			\| No crash/hang ever occurred when using amiibo in-game for "Cave of Shadows".
			With the amiibo quick-start option at the title-screen, only errors ever occurred(<quick-start data not found> / <quick-start data is for another user>).
	\|}		\|}

	= External links =		= External links =
	* [http://wiiubrew.org/wiki/Wii_U_GamePad Wii U Gamepad and Amiibo information on WiiUBrew].		* [http://wiiubrew.org/wiki/Wii_U_GamePad Wii U Gamepad and Amiibo information on WiiUBrew].

2016-10-21T21:06:38Z

Games using Amiibo AppData

← Older revision		Revision as of 01:06, 22 October 2016
Line 351:		Line 351:
	\| The entire AppData is read by the game, but only the first 0x10-bytes are actually used.		\| The entire AppData is read by the game, but only the first 0x10-bytes are actually used.
	\| No crash ever triggered via AppData fuzzing.		\| No crash ever triggered via AppData fuzzing.
			\|-
			\| Mario & Luigi: Paper Jam
			\| Yes
			\| No
			\| 0x00132600
			\| Starts with the process-name("MILLION"). The rest seems to be bitmasks maybe?
			\| No crash ever triggered via AppData fuzzing, when viewing "character cards"(just unlocks various cards).
	\|}		\|}

	= External links =		= External links =
	* [http://wiiubrew.org/wiki/Wii_U_GamePad Wii U Gamepad and Amiibo information on WiiUBrew].		* [http://wiiubrew.org/wiki/Wii_U_GamePad Wii U Gamepad and Amiibo information on WiiUBrew].

2016-08-08T21:56:25Z

Add data structure info for identifying an Amiibo

@@ Line 119: / Line 119: @@
 |-
 | 0x0
-| 0xC
+| 0x8
 | ?
 |-
@@ Line 125: / Line 129: @@
 | 0x20
 | Probably a SHA256-(HMAC?) hash.
 |}

2016-04-30T23:41:53Z

Games using Amiibo AppData

← Older revision		Revision as of 03:41, 1 May 2016
Line 316:		Line 316:
	\| Yes		\| Yes
	\| No		\| No
	\| ?		\| 0x00152600
	\| The entire AppData is read by the game, but only the first 0x10-bytes are actually used.		\| The entire AppData is read by the game, but only the first 0x10-bytes are actually used.
	\| No crash ever triggered via AppData fuzzing.		\| No crash ever triggered via AppData fuzzing.

2016-04-30T22:35:24Z

Games using Amiibo AppData

← Older revision		Revision as of 02:35, 1 May 2016
Line 309:		Line 309:
	\| Yes		\| Yes
	\| No		\| No
	\| ?		\| 0x0014F000
	\| N/A		\| N/A
	\| The initial AppData handling doesn't appear to have any vuln(s), going by manual code-RE for update v2.0. Fuzzing wasn't attempted.		\| The initial AppData handling doesn't appear to have any vuln(s), going by manual code-RE for update v2.0. Fuzzing wasn't attempted.

2016-04-30T13:53:11Z

Structure of Amiibo settings

← Older revision		Revision as of 17:53, 30 April 2016
Line 195:		Line 195:
	\| 0x1		\| 0x1
	\| 0x1		\| 0x1
	\| Country Code ID. This is copied to the struct used with [[NFC:GetAmiiboSettings]].		\| Country Code ID, [[Config_Savegame\|from]] the system which setup this amiibo. This is copied to the struct used with [[NFC:GetAmiiboSettings]].
	\|-		\|-
	\| 0x2		\| 0x2

2016-04-30T13:38:04Z

Structure of Amiibo settings

← Older revision		Revision as of 17:38, 30 April 2016
Line 195:		Line 195:
	\| 0x1		\| 0x1
	\| 0x1		\| 0x1
	\| ~~Unknown~~. This is copied to the struct used with [[NFC:GetAmiiboSettings]].		\| Country Code ID. This is copied to the struct used with [[NFC:GetAmiiboSettings]].
	\|-		\|-
	\| 0x2		\| 0x2