[FINISHED] a popular toy Lego Dimensions

trasixes · 2016-02-10 04:12:12

What is the appropriate data for 0x23-0x26? Isnt 0x25-0x26 the encrypted character ID?

ags131 · 2016-02-10 04:27:00

0x24-0x25 is the encrypted character ID, the rest are 0s on characters,
0x24,0x26 is upgrades, 0x25 is ID, 0x27 is 1 for vehicles

trasixes · 2016-02-10 05:23:16

ags131 wrote:

0x24-0x25 is the encrypted character ID, the rest are 0s on characters,
0x24,0x26 is upgrades, 0x25 is ID, 0x27 is 1 for vehicles

Does the PWD read in android? I generated the PWD from the UID, and tried writing it to tag, but when I read it the tag the PWD shows 0s.

bettse · 2016-02-10 06:07:56

trasixes wrote:

when I read it the tag the PWD shows 0s.

http://www.nxp.com/documents/data_sheet/NTAG213_215_216.pdf
Section 8.8.1

trasixes · 2016-02-10 07:26:00

Thanks for the help guys. I got it working. My problem was silly.

I just realized someone else mentioned the same issue. Had a typo in the Char ID, and it caused UR message. However, even after correcting the typo, the UR message persisted until I rebooted the Xbox.

Pixel166 · 2016-02-10 08:36:09

Hi,

I currently don't have empty tags, but I'm wondering if there is a risk to "brick" an empty tag doing some bad writes (or reads).
For example, is it possible to write a new password on top of a previous one that could be bad ? Is it possible to "reset" a tag ?
I'm asking because I'm totally new to NFC, and I don't want to break some things, and I saw in this thread that a simple typo could lead to an error.

I also have another question : why the toy pad can't write the PWD ? Is it an hardware limitation ? Or a software one ?

Thanks for the answers. I hope to receive the empty tags soon to start some experimentations.

belette · 2016-02-10 09:20:50

http://www.nxp.com/documents/data_sheet/NTAG213_215_216.pdf

8.5.2 Static lock bytes (NTAG21x)

8.5.3 Dynamic Lock Bytes

Correct me if it is not this

bettse · 2016-02-10 18:13:23

Pixel166 wrote:

I also have another question : why the toy pad can't write the PWD ? Is it an hardware limitation ? Or a software one ?

Toypad firmware. It won't write to any page 0x28 or above.

Pixel166 · 2016-02-10 21:41:43

Ok. So to create a tag from scratch (véhicule as well as character), one must write the PWD with android (for example), and then the data could be written with the toypad (or android, or any other writer).
The most difficult part is to generate the PWD, based on the uuid, and to not make a typo during this process. After that it seems easier thanks to tools already published... (even the PWD is easy if there is no typo)

Pixel166 · 2016-02-12 16:07:18

ags131 wrote:

ntag213 tags are what I've used, for me it was as simple as writing the pwd to page 0x28 (Toypad can't do this) then writing the 0x23-0x26 with the appropriate data

ags131 wrote:

0x24-0x25 is the encrypted character ID, the rest are 0s on characters,
0x24,0x26 is upgrades, 0x25 is ID, 0x27 is 1 for vehicles

When I read the documentation (http://www.nxp.com/documents/data_sheet/NTAG213_215_216.pdf ), it seems to be 0x28 for the locked pages, and password is at 0x2B. How do you succeed in writing the pwd to 0x28 ?

Also, for the data, all pages are different than yours for vehicle/items : tag type (1 for vehicle/items) is at 0x26, upgrades are at 0x23 and 0x25, and vehicle ID is at 0x24.
Do you start at page 1 (and me at page 0), or one of us is wrong ? or is it different when using blank tags and official tags ? (I'm asking because I successfuly change an item, by changing its ID at 0x24, with an official tag)

I currently don't have any blank tags, so I can't test the password at 0x28 or 0x2B.

ags131 · 2016-02-13 07:59:09

@Pixel166 Not sure why I wrote 0x28, that should be 0x2B, I need to quit replying late at night...
I wrote the PWD to 0x2B using my Android phone, afterwards, I used my library to write the tag data to the tags.

Just checked some of my dumps to make sure, and the offsets I list are correct and are absolute (0 based) offsets, I may have listed wrong ones earlier
on in the thread, I'm not sure, I get the addresses mixed up sometimes.

Pixel166 · 2016-02-13 09:32:21

@ags131 : when you write on blank tags, PWD (with android) and then data (with your library), do you write something to 0x28 (or you just keep dynamic lock pages by default) ?
I'm currently translating your work to Android, in order to have an app that could read and write tags, and I want to prepare all functions for writing to a blank tag so that when I will have one, I could try as soon as I get it
Currently my app is decoding official tags (create password, authenticate, read data, and decrypt them for characters). It also could write to items tags in order to change the item ID.
I'm going to try to decrypt the updates pages (0x23 and 0x25)

trasixes · 2016-02-13 09:41:05

Pixel166 wrote:

@ags131 : when you write on blank tags, PWD (with android) and then data (with your library), do you write something to 0x28 (or you just keep dynamic lock pages by default) ?
I'm currently translating your work to Android, in order to have an app that could read and write tags, and I want to prepare all functions for writing to a blank tag so that when I will have one, I could try as soon as I get it
Currently my app is decoding official tags (create password, authenticate, read data, and decrypt them for characters). It also could write to items tags in order to change the item ID.
I'm going to try to decrypt the updates pages (0x23 and 0x25)

I use an android app named "Mifare++ Ultralight" from the Play store. It allows you to read, write, and edit the data from within the app easily. It also shows the page # for each page. Write the encrypted character ID info to pages 36/37 (0x24h/0x25h), then PWD to page 43 (0x2Bh), write it back to the tag, and you're done.

Last edited by trasixes (2016-02-13 09:42:41)

Pixel166 · 2016-02-13 09:48:52

@trasixes : I also have that app, but as I'm a developper, I couldn't resist to make my own app, dedicated to this purpose
It's more like a game, than just to create new tags (as my official Lego Dimensions collection is already nearly full ...)
Doing this let me understand the NFC protocol, and as a binus, it gave me the possibility to create backup of my tags on thinner tags (very interesting when traveling with the game)

So the app is dedicated to Lego Dimensions, and for example, when I'm using a Lego Dimensions tag on my android phone, it gave me the type (character or item/vehicle), and the name. Next step is to introduce upgrades for items.

trasixes · 2016-02-13 09:54:18

Pixel166 wrote:

@trasixes : I also have that app, but as I'm a developper, I couldn't resist to make my own app, dedicated to this purpose
It's more like a game, than just to create new tags (as my official Lego Dimensions collection is already nearly full ...)
Doing this let me understand the NFC protocol, and as a binus, it gave me the possibility to create backup of my tags on thinner tags (very interesting when traveling with the game)
So the app is dedicated to Lego Dimensions, and for example, when I'm using a Lego Dimensions tag on my android phone, it gave me the type (character or item/vehicle), and the name. Next step is to introduce upgrades for items.

Very nice! If you need a tester, let me know. I have several tags available for testing/experimentation.

belette · 2016-02-14 16:08:22

Me to (another french user)

Kurapika666 · 2016-02-16 22:10:05

spluton wrote:

lupin3rd wrote:
blofeld wrote:
thanks to ags131
Have now got aquaman and gamer kid in game using some blank tags I bought wrote to pages 36, 37 and 43.
How did the algorithms get found ? I liked reading the posts "[UL-EV1] [SOLVED] italian public transportation system" and seeing you guys work it out was it similar?
Question: I understand writing the character's ID to one of the pages, but what did you write to the other 2 pages?
pages 36 and 37 - character's ID encrypted (8 byte)
page 43 - PWD (4 byte)
or
page 38 - {0x00,0x01,0x00,0x00} (Vehicle or gadget tag)

I tried to read my LD figs with "Mifare++ Ultralight", the app only show 32 pages, not 44

Another strange thing, my tardis have update on it, but pages 24 to 26 are blanks (00000000).

I'm a novice in nfc protocol, maybe I juste misunderstood the meaning of pages ?

trasixes · 2016-02-16 22:13:41

Kurapika666 wrote:

spluton wrote:
lupin3rd wrote:
Question: I understand writing the character's ID to one of the pages, but what did you write to the other 2 pages?
pages 36 and 37 - character's ID encrypted (8 byte)
page 43 - PWD (4 byte)
or
page 38 - {0x00,0x01,0x00,0x00} (Vehicle or gadget tag)

I tried to read my LD figs with "Mifare++ Ultralight", the app only show 32 pages, not 44
Another strange thing, my tardis have update on it, but pages 24 to 26 are blanks (00000000).

I'm a novice in nfc protocol, maybe I juste misunderstood the meaning of pages ?

You can't read beyond 32 pages on genuine character tags because the lock bits are set to prevent it.

Kurapika666 · 2016-02-17 09:42:00

But I have the same result with the tardis, wich is a vehicule, not a character.

Plus I don't understand how you find the character's ID on page 36/37 if your can't read beyond 32.

You said "Write the encrypted character ID info to pages 36/37 (0x24h/0x25h), then PWD to page 43 (0x2Bh), write it back to the tag, and you're done.", but how can you do this with Mifare++ if the app can't show all pages?

Last question : is the UID generated by the portal, or is it the samed for all ? For exemple does all Doctor Who have the same UID?

iceman · 2016-02-17 10:11:25

you'll need the pwd, with it you can read all data.

Pixel166 · 2016-02-17 11:04:13

Kurapika666 wrote:

But I have the same result with the tardis, wich is a vehicule, not a character.
Plus I don't understand how you find the character's ID on page 36/37 if your can't read beyond 32.
You said "Write the encrypted character ID info to pages 36/37 (0x24h/0x25h), then PWD to page 43 (0x2Bh), write it back to the tag, and you're done.", but how can you do this with Mifare++ if the app can't show all pages?
Last question : is the UID generated by the portal, or is it the samed for all ? For exemple does all Doctor Who have the same UID?

I don't know how to use the PWD with the Mifare++ app, and it's why I decided to wrote my own app.
After a successful authentication, all encrypted pages become readable.

If I'm not wrong, the UID is unique for each tag, so two identical characters or vehicles will have different UID. It's the reason why the pwdgen algorythm was needed : each tag have a different pwd

Kurapika666 · 2016-02-17 16:15:20

Thanks for your answers.

I'd read that you were making an app (I'll be interested when it'll be ready), but my question about Mifare++ was for trasixes who said he was reading/writing all pages with it.

Kurapika666 · 2016-02-18 22:08:26

Pixel166, could you contact me by email (kurapikashinji@free.fr) ? I have some question about your app

Thanks!

trasixes · 2016-02-18 22:19:20

Kurapika666 wrote:

Thanks for your answers.
I'd read that you were making an app (I'll be interested when it'll be ready), but my question about Mifare++ was for trasixes who said he was reading/writing all pages with it.

I was referring to blank tags. You can read/write all pages of a blank/non-lego tag using the Mifare++ app. There really is no need to dump or modify a genuine character tag, unless you are modifying upgrades or something (do upgrades exist for characters?).

To modify vehicles, I use Newvehicle.js from Ags131's awesome node-ld.

Further, the UID is unique to every tag, and cannot be changed. The UID is used in pwd generation, so 1:1 cloning of a tag is not possible (to my knowledge, anyway).

Last edited by trasixes (2016-02-18 22:22:19)

Kurapika666 · 2016-02-18 23:17:33

Thanks for your answer.

I already managed to see all pages of a blank tag with mifare++.
You said there's no need to dump a character tag, but don't I need a specific data for all pages to work?

I supposed all pages except (UID/PWD, 36/37 and those for vehicules upgrades) are usefull for the portal to accept it, am I wrong?

Or does the portal only read UID/PWD, and then go direct to pages 36 and 37 ?

For example, need I just to set value "A61C" on page 36 of a blank tag to get batman?

Decimal Hex Character
7334 A61C Batman

ags131 · 2016-02-19 00:40:34

@kurapika666 The game only cares about correct PWD and the pages 36 - 39
Batman has an ID of 01, so the contents of 37 and 38 would be the encrypted value of [ 00 00 00 01 00 00 00 01 ]
(4 byte version of ID repeated)
page 39 is either [ 00 00 00 00 ] for characters
or [ 01 00 00 00 ] for vehicles

Kurapika666 · 2016-02-19 09:24:37

Ok so, for example, if I want to put The Doctor (ID 15) on a blank tag, I need to set :

Page 36 = 0000000F
Page 37 = 0000000F
Page 38 = 00000000
Page 39 = 00000000
Page 43 = generated pwd obtained with http://ldpwd.ericbetts.org

And the tardis (ID 1030) would be :
Page 36 = 00000406
Page 37 = 00000406
Page 38 = 00000000
Page 39 = 01000000
Page 43 = generated pwd obtained with http://ldpwd.ericbetts.org

Am I right this time?

ags131 · 2016-02-19 15:06:45

ags131 wrote:

0x24-0x25 is the encrypted character ID, the rest are 0s on characters,
0x24,0x26 is upgrades, 0x25 is ID, 0x27 is 1 for vehicles

@kurapika666 ^ You may want to glance back over the thread, theres some helpful stuff posted throughout.

Kurapika666 · 2016-02-19 21:36:22

I tried to understand before my 1st post, by reading everything multiple time, but it's too complex for me.
I'm a .Net developer, but never have any knowledge in encryption, hacking, and all security stuffs.

For exemple when DRRB said "12 04 => 04 12 => 0x0412 => 1042 => "Shelob the Great"", I don't understand the logic from 1204 to 1042 (except if it's always an anagram? ). And after that, I don't know how encrypt it to know the hex value to put in the blank tag.

ags131 · 2016-02-19 21:42:10

12 04 => 04 12 is swapping the order of the bytes (This is all hex here)
04 12 => 0x0412 is just combining the two bytes into one hex value
0x0412 => 1042 is converting that hex value into decimal
1042 => "Shelob the Great" is simply looking up the character ID in one of the lists. (Theres a JSON list in my repo under the data folder)
Hex is just BASE16 while decimal is BASE10. We deal with hex more often in this stuff since its easier to associate with raw values and is a friendly way of displaying binary data.

Pixel166 · 2016-02-19 21:50:38

Kurapika666 wrote:

Pixel166, could you contact me by email (kurapikashinji@free.fr) ? I have some question about your app
Thanks!

Done this afternoon.

Kurapika666 · 2016-02-19 22:26:55

@ags131 : So for the tardis, 1030 become 00000604 on pages 36/37 ?

1030 = 0406 in hexa, and swapping the bytes gives 0604

@Pixel166 : I was answering at the same time you posted this

Kurapika666 · 2016-02-19 23:11:49

Well I'm stupid
It won't work because i need the encrypt result of 0604... but how can I found the encrypt values?

And does the page 39 (0100000 for vehicules) need to be encrypted too?

Pixel166 · 2016-02-19 23:47:10

Vehicles and items Id doesn't need to be encrypted, just the swapped bytes of hex value.
The 01 for vehicles doesn't need to be encrypted too.
Encryption is just for character id.

bettse · 2016-02-19 23:49:10

I don't understand the logic from 1204 to 1042

https://en.wikipedia.org/wiki/Endianness

It won't work because i need the encrypt result of 0604

You have been switching from questions about characters to questions about vehicles, and since only characters use encrypted data, I think you're getting confused.

Kurapika666 · 2016-02-20 10:06:07

In fact I asked question about Tardis and and the doctor, just before ags131 told me about encryption
I already tried Tardis before my post #104, and it didn't worked. That's why I supposed it needed encryption too.

Here are my tests with Tardis (ID 1030) :

Page 36 = 00000604
Page 37 = 00000604
Page 38 = 00000000
Page 39 = 01000000
Page 43 = 3553a652 (the UID of my blank tag is 04ECB7E26F3F80)

The game gives a message "You need to update the game blah blah blah"

And for the Doctor, because it needs encryption, I don't know what to write.

But you're right bettse, I'm confused

trasixes · 2016-02-20 10:12:29

Close, have a look at Ags131's "newvehicle.js"

ags131 · 2016-02-20 10:16:00

@kurapika666 Pages are 4 bytes, therefore, when you swap endian you have to swap all 4 bytes
00 00 04 06 => 06 04 00 00
(Note: I'm not sure which way the PWD is, so if it doesn't work one way try flipping it

Kurapika666 · 2016-02-20 12:34:35

Still don't work \o/

I have some questions about ags131's files (https://github.com/ags131/node-ld/blob/master/samples/newVehicle.js)

It writes values 00 00 00 00 in pages 37 to 39, but shouldn't it be 01 00 00 00 on page 39?
And on page 36, he wrote "0x8E, 0x04, 0x00, 0x00", so I suppose it's the Slime Streame (ID 1166)

My test for the tardis which don't work are :

Page 36 = 06040000
Page 37 = 06040000
Page 38 = 00000000
Page 39 = 01000000
Page 43 = 3553A652 (also tried endian writing so 52A65335)

Pixel166 · 2016-02-20 12:44:36

As far as I know, for tardis, it should be :
page 0x23 (35) : 00000000
page 0x24 (36) : 06040000
page 0x25 (37) : 00000000
page 0x26 (38) : 00010000
page 0x2b (43) : 3553A652 (your pwd)

Kurapika666 · 2016-02-20 14:00:07

You guys are amazing

It works for my Tardis.

So page 36 is the only one needed for vehicules (+ 1 in page 38), and for characters it's 36/37, am I right?

Weird thing, I tried with 3 blank tags, get their own PWD, and 1 of them isn't recognized by the game... good thing I didn't start with this one, because I would never be able to make it work

I tried to update the tardis (07040000 on page 36), it worked too

Last thing I still need to know, is how obtain the encrypted value for a character. Is it humanly possible to get the value, or does I have to install ags131's node-ld solution and use the portal with charCryptoExample.js ?

ags131 · 2016-02-20 17:50:55

online PWD gen http://ldpwd.ericbetts.org

Kurapika666 · 2016-02-20 19:05:12

I thought it was only for the pwd related to the blank tag IUD

Here's my test, with batman, using your explaination at the post #177

Batman has an ID of 01, so the contents of 37 and 38 would be the encrypted value of [ 00 00 00 01 00 00 00 01 ]

--> I swap, and obtain 01 00 00 00 01 00 00 00
--> Remove the 4th byte (because PWD gen work this way with tag IUD) 01 00 00 01 00 00 00
--> PWD gen gives 84b031f4

So I wrote :
page 0x24 (36) : 84B031F4
page 0x25 (37) : 84B031F4
page 0x26 (38) : 00000000
page 0x2b (43) : 3553A652 (pwd of my blank tag)

Not recognized I also tried swaping bytes at pages 36/37 F431B084, but same result.

What step did I miss (or did I do more step that needed?)

Vehicules are now Ok. I managed to update equippments too

ags131 · 2016-02-20 20:35:18

http://ldcharcrypto.ags131.com/
Heres a page that does the character encryption, it takes UID as hex and a single decimal number as ID (Ex: 1)
The output should already be flipped for placing in the tag.

Kurapika666 · 2016-02-20 22:12:18

Thanks for this.

But it's super weird (or I'm really super dumb ).

Tried batman --> UID of my tag 04ECB7E26F3F80 + batman's Id 1
==> result is 35C68574 87D87E97

Yeah batman works !!!!

I tried Chell (id 10) so 04ECB7E26F3F80 & 10
==> result is 35C68574 87D87E97 ------> Batman appeared tried to swap, Batman too... try with ID 33, batman too Oo

Try to put tardis again --> "you have to update the game".
Batman again --> "you have to update the game"

So my tag don't want to work anymore, and I still don't get why I had always batman evn by changing the ID on your website.

bettse · 2016-02-20 22:13:50

The game caches UID -> character data. Do not reuse a token without restarting the game.

ags131 · 2016-02-20 22:14:04

The game remembers UIDs of characters, so to get it to accept different contents, the game has to be restarted. Vehicles aren't as picky, but if you switch from a character to a vehicle the game thinks its still a character.

Kurapika666 · 2016-02-20 22:21:11

I also have something strange with some tags

When I put them on the portal, it's not recognized, and I don't have any message too. Even with good PWD and with vehicules (that I now understand )

bettse · 2016-02-20 22:27:36

it's not recognized

There are a lot of layers to the system between the NFC seeing the tag and the game showing a character. If you want to validate if the tag was seen on an NFC level, you need to use the toypad with your own client software and watch for the 0x56 messages when the tag is seen. Then, you could send a read command to the toypad, and if you get back data, it means it both authenticated (validating the PWD was correct), as well as read.

Kurapika666 · 2016-02-20 22:44:23

Thank you all for helping me with my (too) many questions

It works now, even if I have some trouble with tag not recognized in game (I'll try your solution bettse when I found some free time)

I'll try to play with vehicules enhancements now

Proxmark3 community

Announcement

#151 2016-02-10 04:12:12

Re: [FINISHED] a popular toy Lego Dimensions

#152 2016-02-10 04:27:00

Re: [FINISHED] a popular toy Lego Dimensions

#153 2016-02-10 05:23:16

Re: [FINISHED] a popular toy Lego Dimensions

#154 2016-02-10 06:07:56

Re: [FINISHED] a popular toy Lego Dimensions

#155 2016-02-10 07:26:00

Re: [FINISHED] a popular toy Lego Dimensions

#156 2016-02-10 08:36:09

Re: [FINISHED] a popular toy Lego Dimensions

#157 2016-02-10 09:20:50

Re: [FINISHED] a popular toy Lego Dimensions

#158 2016-02-10 18:13:23

Re: [FINISHED] a popular toy Lego Dimensions

#159 2016-02-10 21:41:43

Re: [FINISHED] a popular toy Lego Dimensions

#160 2016-02-12 16:07:18

Re: [FINISHED] a popular toy Lego Dimensions

#161 2016-02-13 07:59:09

Re: [FINISHED] a popular toy Lego Dimensions

#162 2016-02-13 09:32:21

Re: [FINISHED] a popular toy Lego Dimensions

#163 2016-02-13 09:41:05

Re: [FINISHED] a popular toy Lego Dimensions

#164 2016-02-13 09:48:52

Re: [FINISHED] a popular toy Lego Dimensions

#165 2016-02-13 09:54:18

Re: [FINISHED] a popular toy Lego Dimensions

#166 2016-02-14 16:08:22

Re: [FINISHED] a popular toy Lego Dimensions

#167 2016-02-16 22:10:05

Re: [FINISHED] a popular toy Lego Dimensions

#168 2016-02-16 22:13:41

Re: [FINISHED] a popular toy Lego Dimensions

#169 2016-02-17 09:42:00

Re: [FINISHED] a popular toy Lego Dimensions

#170 2016-02-17 10:11:25

Re: [FINISHED] a popular toy Lego Dimensions

#171 2016-02-17 11:04:13

Re: [FINISHED] a popular toy Lego Dimensions

#172 2016-02-17 16:15:20

Re: [FINISHED] a popular toy Lego Dimensions

#173 2016-02-18 22:08:26

Re: [FINISHED] a popular toy Lego Dimensions

#174 2016-02-18 22:19:20

Re: [FINISHED] a popular toy Lego Dimensions

#175 2016-02-18 23:17:33

Re: [FINISHED] a popular toy Lego Dimensions

#176 2016-02-19 00:40:34

Re: [FINISHED] a popular toy Lego Dimensions

#177 2016-02-19 09:24:37

Re: [FINISHED] a popular toy Lego Dimensions

#178 2016-02-19 15:06:45

Re: [FINISHED] a popular toy Lego Dimensions

#179 2016-02-19 21:36:22

Re: [FINISHED] a popular toy Lego Dimensions

#180 2016-02-19 21:42:10

Re: [FINISHED] a popular toy Lego Dimensions

#181 2016-02-19 21:50:38

Re: [FINISHED] a popular toy Lego Dimensions

#182 2016-02-19 22:26:55

Re: [FINISHED] a popular toy Lego Dimensions

#183 2016-02-19 23:11:49

Re: [FINISHED] a popular toy Lego Dimensions

#184 2016-02-19 23:47:10

Re: [FINISHED] a popular toy Lego Dimensions

#185 2016-02-19 23:49:10

Re: [FINISHED] a popular toy Lego Dimensions

#186 2016-02-20 10:06:07

Re: [FINISHED] a popular toy Lego Dimensions

#187 2016-02-20 10:12:29

Re: [FINISHED] a popular toy Lego Dimensions

#188 2016-02-20 10:16:00

Re: [FINISHED] a popular toy Lego Dimensions

#189 2016-02-20 12:34:35

Re: [FINISHED] a popular toy Lego Dimensions