Skylanders NFC

Introduction

Hello fellow skylander enthusiast! If you’ve been searching for a way to clone any skylander to 10 cent NFC cards or modify their data (modify data coming soon), look no further! This is the one-stop, easy tutorial for making skylanders yourself using bin files on the internet. We will only be using GUIs on Windows, so no Linux, command prompt, or coding experience is required. I will try to make this as straightforward as possible:

Step 1: Acquiring Materials

Before we begin, you must acquire four things:

  • ACR122u
  • Magic NFC Tags
  • (Lego Dimension gebruikt NTag 213)
  • NFC Writer Software
  • Skylander Files

ACR122u
The ACR122u is the tool we will use to write data to our fake skylanders, and is easy to buy on Amazon or AliExpress. Due to availability, price, and ease of use reasons I strongly recommend you purchase an ACR122u. There are many other NFC writers on the market; the PN532 and proxmark3 come to mind. However, the ACR122u is cheaper and more readily available. For more advanced NFC work you might want to get the proxmark3 or Chinese GRID PN532 but we won’t need them here. Again, I cannot stress this enough, buy an ACR122u for the easiest time.

Magic NFC Tags
This is the most confusing part of the tutorial. Without getting too technical, Skylanders and other NFC toys use NFC tags to transmit information. Skylander toys in particular use the Mifare Classic standard, which divides each tag’s storage into sectors and blocks. “Normal” NFC tags have the first block, block 0, locked by the factory. This means that the block cannot be written over or changed. block 0 is special because it contains the unique UID number of the tag, and guess what Skylanders games use to identify skylanders – that’s right, the UID. So, we need special “magic” tags made by Chinese manufacturers where block 0 is blank and able to be written to.

But we run into an issue – sellers on ebay, amazon, and aliexpress all mis-indentify tags and use a million different, sometimes meaningless or deceptive, ways to describe them. I would advise ordering tags off of Amazon due to the generous return policy for first-time buyers, and ONLY using AliExpress if you are 100% confident in what you are getting.

There is no 100% certain way to identify the kind of tags we need, but they NEED to be described like this:

  • Block 0 Writable
  • 1k
  • 13.56Mhz

The following extra descriptors are bonuses if you want to be certain you’re getting a tag capable of cloning:

  • s50
  • MF1
  • “Chinese Magic Card”

However, if you see the card described in any of these ways, avoid them:

  • s70
  • MF4k
  • UID Locked
  • 7byte UID

Lastly, there are two “generations” of Magic Cards. Either generation will work for this tutorial, so don’t worry if you see “gen 1” or “gen 2” in seller descriptions.

NFC Writer Software
Note: The password to all files is my username

Eventually I’ll get around to making an “all in one” tool that guides users through the entire process and is bundled into a single executable. But for now, I’ve gone ahead and created a .zip file of everything we will need in terms of software, called Skylanders Toolkit. [link] Note: This will eventually be outdated, as it includes tools currently in development. If you get an error, try an updated build of MWT (the software we will use in a later step), which you can find here. Also, I take no credit for the tools present in this collection, all credit goes to their original authors and if any of them contact me I will gladly put donation info here.

Skylander Files
This is the data dumped off of Skylanders. NFC-Bank has a fantastic collection which you can find on this website, and is the most complete to date. However, the collection is .bin files originally intended for use by the Maxlander software.

IMPORTANT

The NFC Bank collection will NOT work with our off the shelf writer without some conversion. I’ve gone ahead and made a script based on work I found online to convert them automatically, and you can download the CONVERTED collection below: [link] [archive]

To restate, the .bin files themselves will NOT work with an ACR122u without conversion. If you want to convert them yourself, I made a tutorial for that too: https://nfc-bank.com/threads/2740-Co…nder-bin-Files

And, for transparency sake, I will include the work I based my script off of in the Skylander Toolkit.zip file linked above.

Step 2: Installing Software

Now, we need to install the necessary software to actually use our ACR122u. Open the .zip file you downloaded earlier, and navigate to the following path:

Skylanders Toolkit\Driver\ACS_Driver

Run the setup.exe file, and follow the instructions. Click through and let the program install the ACR driver. Then, navigate to

Skylanders Toolkit\Driver\Libusbk Driver

Run the only file in this folder. This will install the USB drivers we need. Click through, DO NOT check anything extra if given the option. Use the default settings and click next. Just continue clicking Next until it finishes. Now, all of the drivers we need are installed. Time for the actual program we will use – Navigate to

Skylanders Toolkit\Mifare Windows Tool

And run the setup file. This will install Mifare Windows Tool, a translation of MifareOneTool which is in Chinese. It also has a (in my opinion) better interface but most importantly works with our ACR122u. Show the author some love (Github)!

Step 3: Cloning

First, connect your ACR to the computer over USB and open MWT. Then, place a magic tag on top of the writer and click WRITE TAG
img_2.jpg

You should see green text indicating a successful connection to the tag, and a window pop up. Check the box next to “std.keys” and then “Start decrypt tag”.
img_4.jpg

Give it a few seconds, and you should see green text light up the console. Give it another few seconds, and this green text will stop. A new popup window will open, labeled “Write Tag”. Make sure the options you select match the screenshot I put here EXACTLY. I will highlight the sections I changed.
img_6.jpg

Now, you should see a weird file in the “Target dump” section at the bottom. This is fine. Click “Select Source Dump”, and select the .dump or .dmp file you would like to write to the tag, from the previous steps.

Finally, press “Start Cloning” and let the program do its thing! Below is the terminal output you should see if everything worked properly.
img_8.jpg
The most important things to look for is that 64/64 blocks were written and that the card was unlocked. And of course, that the skylander you selected to clone was Camo because he is obviously the best one

Note: If you happen to get an error here, or something doesn’t work, repeat the process with a NEW card, and try the “Chinese magic direct/CUID/gen 2” option!

And that’s it. Enjoy your new skylander! If you want to say thanks, spread this tutorial, archive it places, and archive the files I linked in more places. You never know if Activision will decide to whip out the DMCA hammer again

FAQ

“There’s a Skylander missing from the download link”
Sorry. This isn’t my collection, and hasn’t been updated for some time

“What about Imaginators?”
These have increased security, and dumps are not commonly available

“Is this legal?”
maybe?