It’s not strictly implant related, but I’ve been working on cloning Amiibo from online BIN files to blank NTAG215 cards. (Mods, please feel free to delete this if this is too far off-topic)
I have been working on cloning Amiibo using my Proxmark3 Easy I have for my NeXT. I was using this guide, which I had issues with following due to a lack of clarity in some places, getting too far into the weeds to use as a reference for mass cloning, and using an older version of Proxspace.
I’m using BINs from here:
You will need blank NTAG 215 cards and the Python library PyAmiibo (PyAmiibo can be installed using PIP by using the command python -m pip install PyAmiibo ). This guide assumes the blank NTAG keys are FFFFFFFF. In any instance “ -k FFFFFFFF ” is used, change the FFFFFFFF to whatever the hexadecimal password is. I’m using a Proxmark3 Easy with Iceman RRG Firmware v4.9, and Proxspace v3.9. This is assuming you’ve already gotten the .bin files, whether through dumping them from a separate Amiibo or finding them online.
-
Grab the Amiibo bin, make sure it’s in ProxSpace’s “client” folder (at "ProxSpace\pm3\proxmark3\client " alongside “locked-secret.bin”, “unfixed-info.bin” and “key_retail.bin”. All these files can be easily found online.
-
Put blank card on HF side, and run hf mfu pwdgen -r
-
Note the hexadecimal code next to the word “Amiibo” as {PWD} and the UID code at the top as {UID} .
-
Open the Amiibo BIN file, confirm first 56 digits (ending with 00000000 00000000 00000000 ) have been removed. (You will need to to do this in a HEX editor. I used Atom with a hexadecimal-reading plugin, but there are plenty of editors that can do this)
-
In a separate control panel instance, run python -m amiibo uid {oldBin}.bin {UID} {newBin}.bin . (Depending on how you’ve set your machine up, you may not need to type python -m )
-
Within ProxSpace, run hf mfu restore -k FFFFFFFF -f {newBin}.bin
-
Run hf mfu wrbl -b 3 -d F110FFEE -k FFFFFFFF
-
Run hf mfu wrbl -b 134 -d 80800000 -k FFFFFFFF
-
Run hf mfu wrbl -b 133 -d {PWD} -k FFFFFFFF
-
Run hf mfu wrbl -b 131 -d 00000004 -k {PWD}
-
Run hf mfu wrbl -b 132 -d 5F000000 -k {PWD}
-
Get the first two couplets of hex code using hf mfu rdbl -b 2. Write those down as {PREFIX}
-
Run hf mfu wrbl -b 2 -d {PREFIX}0FE0 -k {PWD}
-
Run hf mfu wrbl -b 130 -d 01000FBD -k {PWD}
Sadly, step 14 will lock the card, which is needed for a Nintendo device to properly read the card. I wish there was another way to do this, because having an NTAG215 implant that isn’t permanently locked to a specific Amiibo would be cool as heck.
)