I got an RFIDler (thanks, Mudge) and wanted to see if I could get it to emulate a Tamagotchi Friends. My Proxmark having experienced an unfortunate demise in which its firmware got stuck in a state where it could do nothing but perform Tamagotchi weddings, I was hoping to continue testing the Tamagotchi Friends’ RFID functionality using the RFIDler.
Circuit not working and don’t know why? Save yourself the work of making up a plausible explanation! Just enter your text into the following form, adding in REASON every time you need an excuse. Or use one of the examples below!
I’ve uploaded a printable set of SSL posters. Having learned from past poster experience, the posters are clearer and in a larger array of sizes. Feel free to print these and use them anywhere!
Letter Ledger A3 B4
I reversed the ‘evolve’ function in the Tamagotchi Friends to make the first ‘growth chart’ for this Tamagotchi version. Growth on the Tamagotchi Friends is determined by how well the Tamagotchi is cared for, its personality, which is set by specific user behaviours and randomness.
I used voltage glitching to dump the code of the Tamagotchi Friends.
Recently, I experimented with the EEPROM of the Tamagotchi Friends. I didn’t manage to get code execution, but it was evident that segments of the EEPROM were copied into RAM, which could be used as a shell code buffer if need be. James Slater suggested using glitching to jump into this buffer, similar to how a Gameboy ROM was dumped.
I dumped the EEPROM of the Tamagotchi Friends and altered it to see if it could be used achieve code execution on the device. The Tamagotchi Friends’ processing of EEPROM data is much more robust than the processing on the TamaTown Tama-Go, and did not contain any obvious vulnerabilities.
I used a Proxmark 3 to emulate the Tamagotchi Friends’ NFC. This confirms it is indeed low-frequency RFID, and shed some light on the NFC format.
I tried decoding the Tamagotchi Friends NFC with a Proxmark 3, but had limited success, so I went back to looking at it with an oscilloscope. I was able to figure out the modulation scheme.
I recently got a Proxmark 3, and used it to read the NFC of the Tamagotchi Friends. This allowed me to get some data on the protocol.
The posters have also been updated to contain a QR code which links to a page on why to avoid each function.