NFC adapter - Revision history

Steven96: Did a lot of research on layer 3 packets by sniffing the connection between the NFC adapter and the 3DS using an IRda usb adapter. Been able to spoof the nfc adapter using the same adapter (see github link at bottom of page)

2019-10-17T19:35:17Z

Did a lot of research on layer 3 packets by sniffing the connection between the NFC adapter and the 3DS using an IRda usb adapter. Been able to spoof the nfc adapter using the same adapter (see github link at bottom of page)

Show changes

Ryccardo: Release info

2016-04-29T20:54:55Z

Release info

← Older revision		Revision as of 00:54, 30 April 2016
Line 1:		Line 1:
	The Nintendo NFC adapter is an ~~upcoming~~ external device which adds NFC capabilities for [[amiibo]]s to old Nintendo 3DS and Nintendo 2DS consoles, using the infrared port on the back of the console.		The Nintendo NFC adapter, formally '''Nintendo NFC Reader/Writer''' and codenamed '''Fangate''', is an external device which adds NFC capabilities for [[amiibo]]s to old Nintendo 3DS and Nintendo 2DS consoles, using the infrared port on the back of the console.

			It launched simultaneously with Animal Crossing Happy Home Designer, with which it's optionally bundled; it can also be bought standalone at a nominal price of 21 €.

	[[File:150217nfcreader-640x360.jpg\|thumb\|right\|250px\|Media preview, as released by Nintendo]]		[[File:150217nfcreader-640x360.jpg\|thumb\|right\|250px\|Media preview, as released by Nintendo]]

Ryccardo: /* Technical details */ Alternate chip?

2016-04-29T20:44:46Z

Technical details: Alternate chip?

← Older revision		Revision as of 00:44, 30 April 2016
Line 7:		Line 7:
	Based on analysis of the [[fangate_updater.bin]] file, which is part of the old Nintendo 3DS operating system since [[9.3.0-21]] and contains the firmware running on the external adapter; and analysis of the [[NFC Services]] running on old 3DS.		Based on analysis of the [[fangate_updater.bin]] file, which is part of the old Nintendo 3DS operating system since [[9.3.0-21]] and contains the firmware running on the external adapter; and analysis of the [[NFC Services]] running on old 3DS.

	* SOC inside the adapter: Broadcom BCM20791B1		* SOC inside the adapter: Broadcom BCM20791B1 or ST proprietary "MCU-FGT/rev.A/GH24S VQ"
	* CPU: ARM Cortex M0		* CPU: ARM Cortex M0
	* Communications: infrared, with [[ir:USER]] running on the console. Uses obfuscated payloads. Baud rate is 115200 bps.		* Communications: infrared, with [[ir:USER]] running on the console. Uses obfuscated payloads. Baud rate is 115200 bps.

Socram8888: Edited with easier to read code

2015-05-04T11:28:16Z

Edited with easier to read code

← Older revision		Revision as of 15:28, 4 May 2015
Line 146:		Line 146:
	uint16_t * plain = (uint16_t *) voidplain;		uint16_t * plain = (uint16_t *) voidplain;
	uint16_t * cipher = (uint16_t *) voidcipher;		uint16_t * cipher = (uint16_t *) voidcipher;
	size_t halfCount = size / ~~sizeof(uint16_t);~~		size_t halfCount = size >> 1; // Divide by 2 rounding towards zero

	uint16_t xorval = htobe16(0xE963);		uint16_t xorval = htobe16(0xE963);
Line 160:		Line 160:
	uint16_t * cipher = (uint16_t *) voidcipher;		uint16_t * cipher = (uint16_t *) voidcipher;
	uint16_t * plain = (uint16_t *) voidplain;		uint16_t * plain = (uint16_t *) voidplain;
	size_t halfCount = size / ~~sizeof(uint16_t);~~		size_t halfCount = size >> 1; // Divide by 2 rounding towards zero

	if (~~halfCount~~) {		uint16_t xorval = htobe16(0xE963);
	size_t i;		size_t i;
	~~for (i = halfCount - 1; i > 0; i--) {~~
	~~plain[i] = cipher[i] ^ cipher[i - 1];~~
	}

	plain[0] = cipher[0] ^ ~~htobe16(0xE963)~~;		for (i = 0; i < halfCount; i++) {
			uint16_t word = plain[i];
			cipher[i] = xorval ^ word;
			xorval = word;
	}		}
	}</nowiki>		}</nowiki>

Socram8888 at 14:34, 20 April 2015

2015-04-20T12:34:53Z

Show changes

Socram8888: /* Samples */

2015-04-20T12:23:42Z

Samples

← Older revision		Revision as of 16:23, 20 April 2015
Line 301:		Line 301:
	{\| class="wikitable"		{\| class="wikitable"
	\|-		\|-
	! ~~Raw~~		! Layer 1 packet
	! ~~Deobfuscated~~		! Layer 2 packet
	\|-		\|-
	\| <code>A5 00 08 73 FE A5 C4 A4 2C A4 20 F5</code>		\| <code>A5 00 08 73 FE A5 C4 A4 2C A4 20 F5</code>

Socram8888: /* Samples */

2015-04-20T12:23:11Z

Samples

← Older revision		Revision as of 16:23, 20 April 2015
Line 298:		Line 298:
	== Samples ==		== Samples ==

	NFC ~~adapter update beacon, as sent by the console~~:		NFC handshake beacons:
	{\| class="wikitable"		{\| class="wikitable"
	\|-		\|-

Socram8888: /* Operation codes */

2015-04-20T12:17:21Z

Operation codes

← Older revision		Revision as of 16:17, 20 April 2015
Line 224:		Line 224:

	=== Operation codes ===		=== Operation codes ===
	{\| class="wikitable~~" style="margin: 0 auto; text-align: center;~~"		{\| class="wikitable"
	\|+IR framing format - long frame		\|+IR framing format - long frame
	\|-		\|-

Socram8888: /* Layer 2 - "ircom" */

2015-04-20T12:16:54Z

Layer 2 - "ircom"

@@ Line 222: / Line 222: @@
 * NFC adapter will ignore packets whose protocol version is not 1. It will not even reply.
 * Connection identifier is a random byte the 3DS assigns to identify the connection should be several connections in range at once. Slave devices must save this value from the initial handshake packet and use it for replies. It must also ignore packets whose connection ID does not match.
 == Samples ==

Socram8888: /* Layer 2 - "ircom" */

2015-04-20T12:11:24Z

Layer 2 - "ircom"

← Older revision		Revision as of 16:11, 20 April 2015
Line 179:		Line 179:

	{\| class="wikitable" style="margin: 0 auto; text-align: center;"		{\| class="wikitable" style="margin: 0 auto; text-align: center;"
	~~\|+IR framing format - long frame~~
	\|-
	! style="border-top: none" \| Byte		! style="border-top: none" \| Byte
	! style="width:10%;"\| 7		! style="width:10%;"\| 7
Line 208:		Line 206:
	\|-		\|-
	! 0x05		! 0x05
	\| colspan="8"\|Connection ~~identificator~~		\| colspan="8"\|Connection identifier
	\|-		\|-
	! 0x06		! 0x06