How to emulate/simulate Amiibo with a Proxmark 3 Easy

Last updated on April 3rd, 2021 at 03:38 pm

In this post I will explain how to use a Proxmark 3 Easy to emulate an Amiibo.

About the Proxmark 3 Easy

The Proxmark 3 Easy was designed and manufactured by Elechouse to be a lower cost alternative to the Proxmark RDV2 and therefor lacks some of the more advanced features. However, it is still capable of much of the same and is readily available from Chinese sellers for a decent price making it an interesting option to get yourself familiar with RFID. Please note that the Proxmark 3 Easy is now obsolete and superseded by the Proxmark 3 RDV 4 and the Proxmark EVO so if you are looking for the latest and greatest the Easy is not really recommended.

Proxmark3 Easy



  • Proxmark 3 Easy


  • latest Proxmark3 client


  1. Prepare the Proxmark 3 Easy and client
    1. Install dependencies
    2. Clone the repo
    3. Disable the ModemManager
    4. Change the default platform
    5. Compile the client
    6. Flash the Proxmark 3 Easy
  2. Convert the Amiibo
  3. Load Amiibo onto the Proxmark’s memory
  4. Emulate the Amiibo

Prepare the Proxmark 3 Easy and client

Install dependencies

sudo apt-get install --no-install-recommends git ca-certificates build-essential pkg-config libreadline-dev gcc-arm-none-eabi libnewlib-dev qtbase5-dev libbz2-dev libbluetooth-dev

Clone the repo

git clone

Disable the ModemManager

sudo systemctl stop ModemManager
sudo systemctl disable ModemManager

Change the default platform

Some additional steps are required in order to use the Proxmark 3 Easy with the latest client. This is because it is now obsolete and a newer device with bigger storage capacity is expected. Start by renaming the file Makefile.platform.sample to Makefile.platform and replace the content with the following:


Compile the Proxmark client

make clean && make all

Flash the Proxmark 3 Easy

$ ./pm3-flash-all

If all goes well the output will look similar to this:

[=] Session log /home/user/.proxmark3/logs/log_20210403.txt
[+] loaded from JSON file /home/user/.proxmark3/preferences.json
[+] About to use the following files:
[+]    /home/user/tools/proxmark3-iceman/client/../bootrom/obj/bootrom.elf
[+]    /home/user/tools/proxmark3-iceman/client/../armsrc/obj/fullimage.elf
[+] Waiting for Proxmark3 to appear on /dev/ttyACM0
 🕑  59 found
[+] Entering bootloader...
[+] (Press and release the button only to abort)
[+] Waiting for Proxmark3 to appear on /dev/ttyACM0
 🕓  59 found
[=] Available memory on this board: 256K bytes

[=] Permitted flash range: 0x00100000-0x00140000
[+] Loading ELF file /home/user/tools/proxmark3-iceman/client/../bootrom/obj/bootrom.elf
[+] Loading usable ELF segments:
[+]    0: V 0x00100000 P 0x00100000 (0x00000200->0x00000200) [R X] @0x94
[+]    1: V 0x00200000 P 0x00100200 (0x00000d50->0x00000d50) [R X] @0x298

[+] Loading ELF file /home/user/tools/proxmark3-iceman/client/../armsrc/obj/fullimage.elf
[+] Loading usable ELF segments:
[+]    0: V 0x00102000 P 0x00102000 (0x00037c98->0x00037c98) [R X] @0x94
[+]    1: V 0x00200000 P 0x00139c98 (0x000017bc->0x000017bc) [RW ] @0x37d2c
[=] Note: Extending previous segment from 0x37c98 to 0x39454 bytes

[+] Flashing...
[+] Writing segments for file: /home/user/tools/proxmark3-iceman/client/../bootrom/obj/bootrom.elf
[+]  0x00100000..0x001001ff [0x200 / 1 blocks]
. OK
[+]  0x00100200..0x00100f4f [0xd50 / 7 blocks]
....... OK

[+] Writing segments for file: /home/user/tools/proxmark3-iceman/client/../armsrc/obj/fullimage.elf
[+]  0x00102000..0x0013b453 [0x39454 / 459 blocks]
        @@@  @@@@@@@ @@@@@@@@ @@@@@@@@@@   @@@@@@  @@@  @@@
        @@! [email protected]@      @@!      @@! @@! @@! @@!  @@@ @@[email protected][email protected]@@
        [email protected] [email protected]!      @!!!:!   @!! [email protected] @[email protected] @[email protected][email protected][email protected]! @[email protected]@[email protected]!
        !!: :!!      !!:      !!:     !!: !!:  !!! !!:  !!!
        :    :: :: : : :: :::  :      :    :   : : ::    : 
        .    .. .. . . .. ...  .      .    .   . . ..    . 
...................... OK

[+] All done

[=] Have a nice day!

Convert the Amiibo

To be able use the Amiibo with the Proxmark it needs to be converted to an emulator file (.eml). This is done with a tool called pm3_amii_bin2eml which can be found in the tools directory inside the Proxmark repo. The output will be redirected to a new file.

$ tools/ ~/projects/amiibo/bokoblin.bin > bokoblin.eml

Character / info: 01 41 00 00 03 5c 09 02
Game     :  014 Breath of the Wild
Character:    1 --
Variation:   00 --
Type     :   00 Figure
Amiibo   : 035c The Legend of Zelda
Series   :   09 The Legend Of Zelda
Last     :   02 (should be 02)

Looks like encrypted file but setting preventing us from decrypting
PWD is blank, recalculating
ACK is blank, fixing
Does not contain header, adding
UID: 0480c72aea4c80
PWD: 0078cc3f
ACK: 80808080

hf mf eload u /home/user/projects/amiibo/bokoblin 
hf 14a sim -t 7 -u 0480C72AEA4C80

Load Amiibo onto the Proxmark’s memory

[usb] pm3 --> hf mf eload u bokoblin.eml
[+] loaded 596 bytes from text file bokoblin.eml
[=] detected new mfu dump format
[=] MFU dump file information
[=] -------------------------------------------------------------
[=]       Version | 00 04 04 02 01 00 11 03 
[=]         TBD 0 | 01 00 
[=]         TBD 1 | 00 
[=]     Signature | 92 58 0B 4C 45 A9 C4 2F A9 01 45 CE 5E 5F 9C 43 09 A4 3D 47 D2 32 A3 D1 68 CB AD E6 7F 81 85 C6 
[=]     Counter 0 | 00 00 00 
[=]     Tearing 0 | 00 
[=]     Counter 1 | 00 00 00 
[=]     Tearing 1 | 00 
[=]     Counter 2 | 00 00 00 
[=]     Tearing 2 | 00 
[=] Max data page | 133 (536 bytes)
[=]   Header size | 56
[=] -------------------------------------------------------------
[=] block#   | data        |lck| ascii
[=] ---------+-------------+---+------
[=]   0/0x00 | 04 80 C7 CB |   | ....
[=]   1/0x01 | 2A EA 4C 80 |   | *.L.



[=] 134/0x86 | 80 80 80 80 | 0 | ....
[=] ---------------------------------
[=] Uploading to emulator memory
[=] ......................................................................................................................................................

[?] You are ready to simulate. See `hf mfu sim h`
[+] Done

Emulate the Amiibo

[usb] pm3 --> hf 14a sim t 7 u 04C25292AA5280
[+] Emulating ISO/IEC 14443 type A tag with 7 byte UID (04 C2 52 92 AA 52 80 ) 
[+] press pm3-button to abort simulation

A little video demonstration:


60 thoughts on “How to emulate/simulate Amiibo with a Proxmark 3 Easy”

  1. Hello , sorry for my poor English . I did the same steps of your post , but my switch can’t recognize my pm3 as a Amiibo . Would you mind to give me the .eml file you use , so that i could figure out whether my hardware is broken or the .bin or .eml file I use is wrong

          1. I change Proxmark3 Easy to Proxmark3 RDV2 , run the same commands , and it works ! That’s weird . Anyway , thanks for your help ! Your article help me save money–I won’t have to buy NTAG215 cards , haha .

    1. Hi Ling, I encountered the same problem, my switch doesn’t detect my pm3 as amiibo at all, as if it is invisible. Did you manage to solve the problem with pm3easy?

        1. Dear Tom, and others

          Absolutely, thank you so much for getting back to me.

          See pics here:

          Pic1: So I installed Oracle Virtualbox, and Ubuntu 19.10. I installed github proxmark3 and downloaded the bin from banks.

          Pic2: Converted the bin to eml with your perl file

          Pic3a-c: ran the two line of codes (note: 3c showed that the output of the file from the perl code, but it generated the path to original bin instead of the eml so I modified it)

          Pic4: the PM3-easy turns green during emulation

          Pic5a-c: Trying to Invite Amiibo Camper in game, 5c shows it timed out and shows fail to read amiibo.

          I actually have an amiibo card and that works no problem so that means my switch controller can read amiibos and is not a source of error.

          What could be the problem?

          thanks so much!!

          1. Thank you, compliments on the documentation very helpful. Did you also flash the bootrom and fullimage after cloning the proxmark3 repo?

        2. Hi Tom,
          Nevermind my previous message,
          I unbricked it and flashed it again but still same situation as before-
          Terminal showing it is emulating but for some reason is not at all detected by the pm3…

        3. (edit, please delete my other two messages)
          Hi Tom,
          Nevermind my previous message,
          I unbricked it and flashed it again but still same situation as before-
          Terminal showing it is emulating but for some reason is not at all detected by the Switch*…

        4. Hi Tom

          yes I used your repo:
          git clone
          followed by
          make udev
          and make clean && make all instead of capital ‘Make’

          Oh, and I used another flasher, because
          client/flasher /dev/ttyACM0 -b bootrom/obj/bootrom.elf armsrc/obj/fullimage.elf
          will always gets stuck here and pm3 still shows a blue light on the pm3 right before each eject:

          .Waiting for Proxmark to appear on /dev/ttyACM0 Found.
          Entering bootloader...
          (Press and release the button only to abort)
          Waiting for Proxmark to reappear on /dev/ttyACM0............. Found.

          Writing segments for file: bootrom/obj/bootrom.elf
          0x00100000..0x001001ff [0x200 / 1 blocks]. OK
          0x00100200..0x00100f5b [0xd5c / 7 blocks]....... OK

          Writing segments for file: armsrc/obj/fullimage.elf
          0x00102000..0x00139f2f [0x37f30 / 448 blocks]....................................

          My flasher.exe works however, it looks this way:

          set /p num= {INSERT port number}
          flasher.exe com%num% -b firmware_win\bootrom.elf
          ping -n 8 >nul
          taskkill /f /im flasher.exe
          flasher.exe com%num% firmware_win\fullimage.elf
          ping -n 3 >nul
          taskkill /f /im flasher.exe

          Could this be a source of difference? or should I try iceman 3 or RRG? But how could I unstuck the linux flashing though?
          Also, is there a variable for the emulation to select the power output NFC runs by, maybe the default value is just too low?
          It still cannot be picked up by the Switch

          Also everytime I run a bunch of these shows up until I ^c it and run it again:

          #db# unknown command:: 0x0154
          #db# unknown command:: 0x0150
          #db# unknown command:: 0x014f
          #db# unknown command:: 0x0152
          #db# unknown command:: 0x0154
          #db# unknown command:: 0xd3f4741
          #db# unknown command:: 0xd3f4754
          #db# unknown command:: 0xd3f4723
          #db# unknown command:: 0xd3f4750
          #db# unknown command:: 0xd3f474f
          #db# unknown command:: 0xd3f4752
          #db# unknown command:: 0xd3f4754
          #db# unknown command:: 0xd3f4743
          #db# unknown command:: 0xd3f4746
          #db# unknown command:: 0xd3f4747

          Not sure if that is also a concern

          1. From what I understand you should always match the repo version and firmware. So if you use the repo I link to in this blog you should also flash the firmware (bootrom and fullimage). From what I can see the bootrom is flashed fine but gets stuck on the fullimage. Have you tried flashing the fullimage only (as root)?

        5. PS I also have a card reader and it seems like the emulation can be detected but very specific placement is required. do you think it is just that the nfc couldn’t pick up the power?

          btw pm3 also has the ‘chameleon module’ with a battery on it, should I remove the battery first?

  2. Hello i have this error on tape this command hf mf eload /root/proxmark3/client/samytools/amiibo.eml

    File Content error. Block data must include 32 HEX symbols.

    Why ?

    1. You are missing the ‘u’ in your command. It should be “hf mf eload u”.

      pm3 –> hf mf eload /home/user/Desktop/amiibo/amiibo
      [!] File content error. Block data must include 32 HEX symbols
      pm3 –> hf mf eload u /home/user/Desktop/amiibo/amiibo

      [+] Loaded 255 blocks from file: /home/user/Desktop/amiibo/amiibo.eml

  3. And if i’m tape hf mf eload i have :

    proxmark3> hf mf eload
    It loads emul dump from the file `filename.eml`
    Usage: hf mf eload [card memory]
    [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K

    sample: hf mf eload filename
    hf mf eload 4 filename

  4. didyouexpectthat

    Crazy. I can reproduce step-by-step with my Proxmark RDV4 but when I go to interface with a Switch, it doesn’t work. I get the same output on the same file from mfubin2eml, I eload the output file, and then simulate the serial… I was playing BotW and it did not work.

    1. didyouexpectthat

      Yes. I grabbed a fresh version of ProxSpace, built and loaded fresh radios for lf and hf from Iceman with no issues, verified everything else works (have some hid cards, read the hid). I wonder if his current version may have a bug. I’ll try some older Iceman builds or maybe on Linux instead.

      1. Please do, I’m curious why it doesn’t work. I used an Ubuntu VM previously. If you can, post the command and output here maybe I can find whats wrong.

          1. Probably not the issue but the first line of your command output shows you running Samy’s script and saving the output of the command as amibo.elf instead of .eml.

  5. When I load the eml file, it gives me: old mfu dump format, was converted on load to 243 pages. After which it says Loaded 257 blocks into emulator memory, and the switch says it might not be an amiibo.

    1. Hi Carl, it seems that the newest proxmark client from the RFID research group is the problem. I just tested the now deprecated iceman1001 version and it works just fine. I shall update my post with this information.

      1. What error were you getting on the Switch? When I use the RRG version, my Switch says “This is not an amiibo.” and in-game, it doesn’t work, but at least I get feedback that indicates failed. I may switch back to the iceman1001 myself.

  6. Hi,

    Thanks for such thorough instructions on this. However, when I was attempting to emulate amiibo with my rdv4, I can’t set the ownership for the emulated amiibo, for each time I tried to do so, my 3ds said that setting had failed, and I get a warning

    #db# Received unknown command (Len=8):
    #db# a2 04 00 00 01 00 ef ab

    on my Kali client. I’m using the depreciated Iceman repo as is specified previously. And since I can’t set the ownership, the 3ds refuse to load the content. Is there anyway to fix this?


  7. Actually, that’s the only way you can use an Amiibo in a game. I’m playing Monster Hunter Stories, and when I put the rdv4 on the bottom screen of the 3ds, it tells me that the owner of the Amiibo is not set, then redirect you to the ownership and nickname setting page. My guess is that there’s an anti-sharing feature, that you can’t share a blank Amiibo with your friends and play with the character at the same time.

    Just wondering if there’s anyway to bypass this and actually use pm3 in a game? Thank you!

    1. So I just checked and it is possible while using a NTAG215 tag. There is some communication with the tag the sets the owner data in the tag. In theory it should be possible with the pm3 but I don’t know if they are going to add support.

    2. What if we set the owner beforehand? I just identified where the owner and nickname are located in the amiibo bin file. If we change it to contain your name and a nickname you want and then simulate it will the 3ds not put 1 +1 together and accept it?

  8. Hi I am quite new to the scene

    I see you guys are using linux?

    Would it work if I install perl interpreter on my windows OS?

      1. I dont know anything but I have managed to do everything but I encounter the same problem as Ling.

        My proxmark3 easy was almost like it is invisible when placed near the controller, it just wouldn’t see it what is wrong?

  9. Looks like I’m unable to find libqt4-dev when trying to install it on Ubuntu in a VirtualBox.

    Meanwhile, trying to build the iceman fork on OSX gives a undefined methodname’ for nil:NilClass`

    Which version of Ubuntu are you running?

      1. Kai,

        I have also tried Cheeplusplus’s fork which bases off RFIDrg, and still while I manage to reflash the firmware, set up the PM3 with appropriate commands, the same problem remains:
        my switch just wouldn’t see my pm3-emulation… Was that a problem you experienced and solved?

        1. So in short the RRG repo does not work. Any fork based on that one will not work. The repo that does work is the one that I mention in the blog. My advice, stick to that repo, flash the proxmark and then try to simulate an amiibo. If flashing the proxmark gets stuck, try it as root or prepare a bare metal machine with ubuntu to use instead of a VM.

      2. Unfortunately I wasn’t able to build your fork on OSX and ran into a lot of issues locating missing packages (qt4 dev) while on Ubuntu 19.1 on Virtualbox, and CheePlusPlus’ didn’t have the OSX patch either. Made the fork for other OSX users

Leave a Reply

Your email address will not be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.