Tamagochi as a key for intercom and travel card in the subway

The video shows the way in which Tamagotchi turns into an interphone key and a travel card for public transport. As a result, we get a dual-band key at 125 kHz and 13 MHz.
As a low-frequency chip is used rewritable Atmel T5577 .
Instead of a travel card, you can use any high-frequency chip, for example, mifare zero to write a student card to it.


')
At first I wanted to open the intercom without any modification of the iron at all, since its protocol is very similar to em4100.
Analysis of the Tamagotchi Friends protocol .
But for this it was necessary to modify the firmware, but no one has yet figured out how to do it.

Here, by the way, is a blog dedicated to the reversing of Tamagotchi natashenka.ca. Its author is Google's employee of Android Secuiry Team.
She was able to crack the Tamagotchi model TamaTown Tama-Go and even made a programmer for him:


I decided to do it extremely simply and solder the chip to my native antenna.
The easiest way to get the T557 chip came out of the interphone keychain, breaking it with pliers.


I expected that the chip soldered directly to the native antenna could cause problems with the wireless functions of the tamagotchi, but this did not happen. And the intercom and tamagotchi worked perfectly. Unless at the moment of the activated function Bump (waiting for a connection with another tamagotchi), the intercom cannot be opened. But it's not a problem.


Much more difficult was the situation with the high-frequency part. Mounting both antennas in the case it was found that the travel card is not readable. I had to play for a long time with the position of the smaller antenna to make it work.
Extracting a chip from a Troika card also proved to be a daunting task; during the shooting of the video, two pieces were broken.

You can pop the ticket by number via the Internet troika.mos.ru/about/pay .
Or in terminals that allow you to simply attach a card, like MegaFon and MTS.


The final scheme looks like this:



References:

Group Tamagotchi Friends Vkontakte vk.com/tamagotchi.friends
Blog about reversing Tamagotchi natashenka.ca
RFID proxmark3 research tool www.proxmark.org