Thursday, November 14, 2013

Updated: Skylanders Hacking



Worked with Skylanders Editor in Windows 8 64 bit.  Here is what I learned:

  1. Editor came with source code and a portal driver.  This is great if I want to play with the code itself and build a Mifare Classic encryption cracker out of it.
  2. You may need to disable the Spyro Portal Service before Editor.exe can talk to a portal.  Do this in services.msc.
  3. I was able to get the PS3 and 3DS wireless portals to work using the driver included in the Editor zip file.
  4. When working with the device in any system post-Vista, make sure to run your command prompt or batch file as an administrator.  This allows such ancient technology to access the USB where the portal connects.
  5. I was unable to get the wired portal to work.  I believe this one is from Skylanders Giants.
  6. I do not have a portal from Swap Force to test it out, but I suspect a new driver will be necessary.
  7. My Nexus will not read Mifare Classic cards with the usual apps.  You need keys and something to teach the NFC reader how to talk using the Mifare proprietary format.
  8. Breaking the Mifare encryption is my next step.  As described in the Editor v2 docs, the key is a bunch of data from Block00-01 and 35 bytes from a constant key.  I have my bead on a Mifare cracker in Backtrack Linux that will do the job quickly. 

Update: After sitting down with the Editor code and some testing, it seems like the author has done all the work for you.  Still planning an exercise to crack the key myself, though.  I conducted a practical upgrade/downgrade test on a first-gen Skylander.  A normal Skylander will go to level 10 in the first release and 15 in "Giants".  The actual Giant figs have yet to be tested, but I expect similar results.  The data pulled the same and decrypted just fine using Editor v2.0. 

Final Note: Don't tell him, but I may get SWAP Force for my son for Christmas just to get a peak at those new guys.  Curious as to how they sense the fig/element match.  It requires a pretty hefty purchase, though, so it is either that or Disney Infinity.
Post a Comment