How to emulate/simulate amiibos with the proxmark3

In this post I will explain how to emulate/simulate Amiibo using the proxmark3. For those who don’t know what a proxmark is here is a short description from the website:

The Proxmark is an RFID swiss-army tool, allowing for both high and low level interactions with the vast majority of RFID tags and systems world-wide. Originally built by Jonathan Westhues over 10 years ago, the device has progressively evolved into the industry standard tool for RFID Analysis.

https://proxmark.com/

Proces:

  1. Download and compile the proxmark client (flash proxmark)
  2. Download and run mfu2bineml
  3. Emulate/simulate the amiibo with the proxmark3
  4. Profit!!!!

Download and compile the proxmark client

#Install dependencies
sudo apt-get install p7zip git build-essential libreadline5 libreadline-dev libusb-0.1-4 libusb-dev libqt4-dev perl pkg-config wget libncurses5-dev gcc-arm-none-eabi

#Clone the proxmark3 GitHub repo
git clone https://github.com/tomvanveen/proxmark3.git

#Install the blacklist rules and add user to dialout group (Linux/ubuntu/debian)
make udev

#Clean and complete compilation
Make clean && make all

#Flash the bootrom and fullimage 
client/flasher /dev/ttyACM0 -b bootrom/obj/bootrom.elf armsrc/obj/fullimage.elf

Download and run mfu2bineml

We are using mfu2bineml, a perl program written by Samy Kamkar, to convert the amiibo to a format the proxmark3 will understand. To do this, simply run the program with the amiibo as input and put the output into a file:

user@ubuntu-vm:~/Desktop/amiibo$ ./mfubin2eml Champion\ Mipha.bin > amiibo.eml

Character / info: 01 07 00 00 03 5a 09 02
Game : 010 The Legend of Zelda
Character: 7 --
Variation: 00 --
Type : 00 Figure
Amiibo : 035a The Legend of Zelda
Series : 09 The Legend Of Zelda
Last : 02 (should be 02)


Looks like encrypted file but setting preventing us from decrypting
Does not contain header, adding
UID: 04c25292aa5280
PWD: 00000000

hf mf eload u Champion Mipha.bin
hf 14a sim t 7 u 04C25292AA5280

Emulate/simulate the amiibo with the proxmark3

The last part of the program will tell you what commands to use in the Proxmark client to load the eml file and emulate/simulate the Amiibo. Because I love tool output here is the output from the Proxmark client: 

pm3 --> hf mf eload u /home/user/Desktop/amiibo/amiibo
…………………………………………………………………………………………………………………………………………………………………………………………………………………………………
[+] Loaded 255 blocks from file: /home/user/Desktop/amiibo/amiibo.eml 
pm3 --> hf 14a sim t 7 u 04C25292AA5280
[+] Emulating ISO/IEC 14443 type A tag with 7 byte UID (04 C2 52 92 AA 52 80 ) 
[+] press pm3-button to abort simulation

And here is a video demonstration of the Amiibo emulation. 

References:

37 thoughts on “How to emulate/simulate amiibos with the proxmark3”

  1. Hello , sorry for my poor English . I did the same steps of your post , but my switch can’t recognize my pm3 as a Amiibo . Would you mind to give me the .eml file you use , so that i could figure out whether my hardware is broken or the .bin or .eml file I use is wrong

          1. I change Proxmark3 Easy to Proxmark3 RDV2 , run the same commands , and it works ! That’s weird . Anyway , thanks for your help ! Your article help me save money–I won’t have to buy NTAG215 cards , haha .

  2. Hello i have this error on tape this command hf mf eload /root/proxmark3/client/samytools/amiibo.eml

    File Content error. Block data must include 32 HEX symbols.

    Why ?

    1. You are missing the ‘u’ in your command. It should be “hf mf eload u”.

      pm3 –> hf mf eload /home/user/Desktop/amiibo/amiibo
      [!] File content error. Block data must include 32 HEX symbols
      pm3 –> hf mf eload u /home/user/Desktop/amiibo/amiibo
      …………………………………………………………………………………………………………………………………………………………………………………………………………………………………

      [+] Loaded 255 blocks from file: /home/user/Desktop/amiibo/amiibo.eml

  3. And if i’m tape hf mf eload i have :

    http://prntscr.com/ma1a30

    proxmark3> hf mf eload
    It loads emul dump from the file `filename.eml`
    Usage: hf mf eload [card memory]
    [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K

    sample: hf mf eload filename
    hf mf eload 4 filename

  4. Crazy. I can reproduce step-by-step with my Proxmark RDV4 but when I go to interface with a Switch, it doesn’t work. I get the same output on the same file from mfubin2eml, I eload the output file, and then simulate the serial… I was playing BotW and it did not work.

    1. Yes. I grabbed a fresh version of ProxSpace, built and loaded fresh radios for lf and hf from Iceman with no issues, verified everything else works (have some hid cards, read the hid). I wonder if his current version may have a bug. I’ll try some older Iceman builds or maybe on Linux instead.

      1. Please do, I’m curious why it doesn’t work. I used an Ubuntu VM previously. If you can, post the command and output here maybe I can find whats wrong.

          1. Probably not the issue but the first line of your command output shows you running Samy’s script and saving the output of the command as amibo.elf instead of .eml.

  5. When I load the eml file, it gives me: old mfu dump format, was converted on load to 243 pages. After which it says Loaded 257 blocks into emulator memory, and the switch says it might not be an amiibo.

    1. Hi Carl, it seems that the newest proxmark client from the RFID research group is the problem. I just tested the now deprecated iceman1001 version and it works just fine. I shall update my post with this information.

      1. What error were you getting on the Switch? When I use the RRG version, my Switch says “This is not an amiibo.” and in-game, it doesn’t work, but at least I get feedback that indicates failed. I may switch back to the iceman1001 myself.

  6. Hi,

    Thanks for such thorough instructions on this. However, when I was attempting to emulate amiibo with my rdv4, I can’t set the ownership for the emulated amiibo, for each time I tried to do so, my 3ds said that setting had failed, and I get a warning

    #db# Received unknown command (Len=8):
    #db# a2 04 00 00 01 00 ef ab

    on my Kali client. I’m using the depreciated Iceman repo as is specified previously. And since I can’t set the ownership, the 3ds refuse to load the content. Is there anyway to fix this?

    Thanks!

  7. Actually, that’s the only way you can use an Amiibo in a game. I’m playing Monster Hunter Stories, and when I put the rdv4 on the bottom screen of the 3ds, it tells me that the owner of the Amiibo is not set, then redirect you to the ownership and nickname setting page. My guess is that there’s an anti-sharing feature, that you can’t share a blank Amiibo with your friends and play with the character at the same time.

    Just wondering if there’s anyway to bypass this and actually use pm3 in a game? Thank you!

    1. So I just checked and it is possible while using a NTAG215 tag. There is some communication with the tag the sets the owner data in the tag. In theory it should be possible with the pm3 but I don’t know if they are going to add support.

    2. What if we set the owner beforehand? I just identified where the owner and nickname are located in the amiibo bin file. If we change it to contain your name and a nickname you want and then simulate it will the 3ds not put 1 +1 together and accept it?

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.