Tamagotchi as a key for the intercom and travel card in the subway

The video shows how to turn Tamagotchi into an intercom key and a pass for public transport. As a result, we get a dual-band key at 125 kHz and 13 MHz.
The rewritable Atmel T5577 is used as a low-frequency chip .
Instead of a travel card, you can use any high-frequency chip, for example, mifare zero to record a student card on it.



At first, I wanted to open the intercom without any modification of iron, since its protocol is very similar to em4100.
Analysis of the Tamagotchi Friends protocol .
But for this it was necessary to modify the firmware, and no one has yet figured out how to do this.

Here, by the way, is a blog dedicated to reversing Tamagotchi natashenka.caIts author is a Google employee from the Android Secuiry Team.
She was able to hack Tamagotchi TamaTown Tama-Go models and even made a programmer for him:


I decided to do it very simply and solder the chip to my native antenna.
The easiest way to get the T557 chip was from a doorphone keychain breaking it with pliers.


I expected that the chip soldered directly in the native antenna could cause problems with the wireless functions of Tamagotchi, but this did not happen. Both the intercom and tamagotchi worked perfectly. Unless at the moment the Bump function is activated (waiting for a connection with another tamagotchi), the intercom cannot be opened. But it's not a problem.


The situation was much more complicated with the high-frequency part. Having mounted both antennas in the case, it turned out that the travel card is not readable. I had to play for a long time with the position of the smaller antenna so that it worked.
Removing the chip from the Troika card also proved to be a daunting task, two pieces were broken during the filming of the video.

You can pay a trip ticket by number via the Internet troika.mos.ru/about/pay .
Or in terminals that allow you to simply attach a card, like Megafon and MTS.


The final diagram looks like this:



Links:

Tamagotchi Friends VKontakte group
vk.com/tamagotchi.friends Tamagotchi reversing blog natashenka.ca
RFID research tool proxmark3www.proxmark.org