Amiibo
|
This article is a Stub. You can help WikiTemp by expanding it. |
All Amiibo appear to use Mifare Ultralight NTAG215. This tag hold 135 4-byte pages, for a total of 540 bytes.
General Amiibo data structure:
| Page | Byte 0 | Byte 1 | Byte 2 | Byte 3 | Encrypted | Mode |
|---|---|---|---|---|---|---|
| 0 (00h) | UID0 | UID1 | UID2 | BCC0 | No | RO |
| 1 (01h) | UID3 | UID4 | UID5 | UID6 | ||
| 2 (02h) | BCC1 | Internal | Static Lock | |||
| 3 (03h) | CC | |||||
| 4 (04h) | 0xA5 | Write Counter | ? | RW | ||
| 5 (05h) | Settings | CRC Counter | Yes | |||
| 6 (06h) | Init Date | Write Date | ||||
| 7 (07h) | CRC | |||||
| 8 (08h) | Nickname | |||||
| ... | ||||||
| 12 (0Ch) | ||||||
| 13 (0Dh) | Locked Hash | No | RO | |||
| ... | ||||||
| 20 (14h) | ||||||
| 21 (15h) | Character # | Variation | Form | |||
| 22 (16h) | Amiibo # | Set | 0x02 | |||
| 23 (17h) | ? | |||||
| 24 (18h) | Keygen Salt | |||||
| ... | ||||||
| 31 (1Fh) | ||||||
| 32 (20h) | Unfixed Hash | RW | ||||
| ... | ||||||
| 39 (27h) | ||||||
| 40 (28h) | Owner Mii | Yes | ||||
| ... | ||||||
| 63 (3Fh) | ||||||
| 64 (40h) | Title ID | |||||
| 65 (41h) | ||||||
| 66 (42h) | Write Counter | Amiibo AppID | ||||
| 67 (43h) | (cont.) | ? | ||||
| 68 (44h) | Hash (?) | |||||
| ... | ||||||
| 75 (4Bh) | ||||||
| 76 (4Ch) | App Data | |||||
| ... | ||||||
| 129 (81h) | ||||||
| 130 (82h) | Dynamic Lock | RFUI | No | RO | ||
| 131 (83h) | CFG0 | |||||
| 132 (84h) | CFG1 | |||||
| 133 (85h) | PWD | WO | ||||
| 134 (86h) | PACK | RFUI | ||||
The UID is the unique serial number for the NFC tag. It is written at the factory cannot be changed in most cases unless you have an emulator or a special "magic Chinese card" that has a backdoor to write the UID.
UID 0 is 0x04 on all Amiibo (and possible all NTAG21x).
BCC 0 is always equal to UID0 ⊕ UID 1 ⊕ UID 2 ⊕ 0x88
BCC 1 is always equal to UID3 ⊕ UID 4 ⊕ UID 5 ⊕ UID6
⊕ is XOR
Byte 1 of Page 2 is an internal value that is permanently set to 0x48 on all Mifare Ultralight chips (except some "magic Chinese" chips). All Amiibo also have this value set to 0x48 so using a different value would probably be pointless.
The lock bytes on all Amiibo are set to 0x0F and 0xE0. This means pages 4-10 are locked. Once these bits are set to 1, they cannot be reset to 0.
Page 21 and 22 set what character is being used. For example, Kirby is 0x1F000000 and 0x000A0002 while Link is 0x01000000 and 0x00040002.
The dynamic lock bytes on all Amiibo are set to 0x01, 0x00, and 0x0F. This locks pages 16-17 and blocks 16-31.
Byte 3 of Page 130 is always 0xBD.
Configuration 0 is set to 0x00000004 and Configuration 1 is set to 0x5F000000 on all Amiibo.
