If you haven’t heard of Skylanders, Disney Infinity, or Amiibo, I’m wondering how you even landed on a blog talking about video games. These NFC Figures, commonly named “Smart Toys” are all the rage these days. There’s a huge and growing market that all toy makers and videogame companies are trying to tap into. Guess who wants to join the fun? Pirates and hackers.

What are Smart Toys?

Smart toys are a recent type of entertainment that mix physical toys, a screen, and a video game. Skylanders is probably the most popular one, followed by Disney’s Inifinity and Nintendo’s Amiibo. Figures are not the only “Smart Toys”. Card games using the same technology have been popular in Japan Arcade centers for a while now.

Because these games are perfect to generate “collectible” types of items, it is a big market. I for one can remember how much money I spent on Magic The Gathering cards, and how much I would easily spend on such games as well. Analysts estimate the “Smart Toys” market could be worth 7 billion dollars by 2018. Today it is between 2 and 3 billion dollars (By comparison, the overall video game market is estimated to be somewhere between 70 and 80 billion dollars).

Side Note: for those of you interested to give it a try, Skylanders Starter packs are reasonably cheap. But be careful, the starter pack is a gateway drug 😛

Here come the hackers

A multi-billion dollar industry growing at such speed is bound to attract lots of people. This includes some hardware hackers and pirates from China, who have announced a new device that aims at “backing up” your Smart Toys. It’s obvious however that most people would use this as a way to create cheap copies of Skylanders or Amiibo.

The announced device, named MaxLander, apparently lets people copy the content of the Toy to an internal database, to then replicate it on a tag that you own. But the videos also imply it also seems to be able to replicate a toy that you did not previously own. Basically letting gamers play any character without having to purchase it. It seems pretty obvious that full databases of all the necessary information to replicate a given toy will be available, one way or another, to the users of this system

How does it work?

The physical toys (Skylanders, etc…) interact with the game through NFC (Near Field Communication) Technology. Each toy has an NFC tag attached to it. NFC tags are basically a passive radio chip with a bit of memory (96 bytes to 32kb). This is enough for each toy to store information identifying it in the game.

NFC is an open technology, so replicating the content on these chips is probably not too difficult. Encryption is involved in all these toys, to avoid easy copies, but sources tell me the encryption mechanism, at least on Activision’s skylander, is not extremely robust and might have been broken already.

It is actually not the first time people try to analyze the Skylanders toys. Hacker Brandon Wilson received a cease and desist several years ago for as little as hosting (not sharing!) a zip file with information on the skylander format. Other tools to “backup” NFC figures exist, and if your phone is equipped with NFC technology, it is already possible today to backup and restore your amiibo, Skylanders, etc… figures with simple Android apps.

If Backing up your own Smart toys is technically doable today (and, realistically, sounds like a fair use of your toys), what the game creators want to avoid is you being able to use new ones without buying them first. For that, it is safe to assume additional security is in place to not let any figure being activated without having being purchased first.

One of the videos picturing the Maxlander shows MaxLander doing a “regular” backup, which is something that is not groundbreaking.

Another video, however, shows the system creating a new skylander “from scratch” (i.e. the person on the video claims to not have previously owned the figure). Now, that is very easy to fake of course on a video, but it is safe to assume the tools actually offer that possibility, otherwise there would be no value in the product, compared to regular Android NFC backup apps.

If the device actually does what it claims, people attempting to resell it to the US or Europe might face heavy legal consequences.

source Maxconsole, Thanks to GaryOPA for the tip