From WikiTemp, the GBAtemp wiki
Revision as of 06:17, 10 September 2015 by SuperSVGA (talk | contribs) (Created the page with a bunch of research I did. Needs more work.)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Stub.png This article is a Stub. You can help WikiTemp by expanding it.

All Amiibo appear to use Mifare Ultralight NTAG215. This tag hold 135 4-byte pages, for a total of 540 bytes.


General Amiibo data structure:

Page Byte 0 Byte 1 Byte 2 Byte 3
Page 0 UID 0 UID 1 UID 2 BCC 0
Page 1 UID 3 UID 4 UID 5 UID 6
Page 2 BCC 1 Internal Lock Bytes
Page 3 Capability Container
Page 21 Character
Page 22
Page 130 Dynamic Lock Bytes Unknown
Page 131 Configuration 0
Page 132 Configuration 1
Page 133 Password
Page 134 Password Ack Unknown

The UID is the unique serial number for the NFC tag. It is written at the factory cannot be changed in most cases unless you have an emulator or a special "magic Chinese card" that has a backdoor to write the UID.

UID 0 is 0x04 on all Amiibo (and possible all NTAG21x).


BCC 0 is always equal to UID0 ⊕ UID 1 ⊕ UID 2 ⊕ 0x88

BCC 1 is always equal to UID3 ⊕ UID 4 ⊕ UID 5 ⊕ UID6

⊕ is XOR


Byte 1 of Page 2 is an internal value that is permanently set to 0x48 on all Mifare Ultralight chips (except some "magic Chinese" chips). All Amiibo also have this value set to 0x48 so using a different value would probably be pointless.

The lock bytes on all Amiibo are set to 0x0F and 0xE0. This means pages 4-10 are locked. Once these bits are set to 1, they cannot be reset to 0.

Page 21 and 22 set what character is being used. For example, Kirby is 0x1F000000 and 0x000A0002 while Link is 0x01000000 and 0x00040002.

The dynamic lock bytes on all Amiibo are set to 0x01, 0x00, and 0x0F. This locks pages 16-17 and blocks 16-31.

Byte 3 of Page 130 is a value that the NFC forum has reserved for future use, yet for some reason Nintendo has set this to 0xBD.

Configuration 0 is set to 0x00000004 and Configuration 1 is set to 0x5F000000 on all Amiibo.