Tamagotchi v5 Familitchi hack – Codes exploited and revealed!

I don’t have a Tamagotchi, but the way it works intrigued me, so (because sudoku it’s interesting, but reverse engineering codes is more) I tried to figure out how does it works.
There are two types of code:
1. Codes generated by the Tamagotchi
2. Codes generated by the site.

The way it works is similar, but not really simple, but I’ll’ try to explain it as best as I can:
– Data are sent in clear format, no encryption.
– Data are organized in a complex way, so it seems the codes are generated random, but they’re not.

First of all, the code is generated from your Tamagotchi using a key for the “encryption” (it’s not an encryption, but only a way to organize data), then data are put into the right sequence and then there’s a counter to prevent people modify data.
There’re 5 different “encryptions”, but 10 different values for it; values 0-1, 2-3, 4-5, 6-7, 8-9 have the same “encryption”, so it’s the same using key 0 or 1, 2 or 3 etc.
Actually I don’t have a code for the encryption keys 6 (or 7), so I don’t know how does it organizes data, and I would like somebody to send me a valid code to find out.

Let’s start seeing the structure:
– LoginMode: L, l (2 digits, don’t know what does it is for)
– Version: V (1 digit, it’s the version of your Tamagotchi. Obviously for the Familitchi is always 5)
– CharacterCode: C, c (2 digits, it’s your character!)
– FamilyCode: F, f (2 digit, I think it’s about your type of family…)
– TiesCode: T (1 digit, don’t know what does it is for)
– EncryptionKey: E (1 digit, it’s the “encryption” key)
– Counter: K (1 digit, it’s the counter, we’ll see this later)

If the EncryptionKey (E) is 0 or 1, this is the structure:
lvfET CLFcK

2,3:
fVCEc KFTLl

4,5:
TLVEc FlKCf

6,7: Unknown
8,9:
LFTEK VlcfC

So… what does it means?
I have a Familitchi and ask for a code.
It says 15131 21000.
Now, first of all, I will check the EncryptionKey. It’s 3.
Then, I’ll read every digit to get the data.
– The first digit is f, the second of FamilyCode. It has value 1, so the FamilyCode is x1. (x is still unknown!)
– The second is V, out Tamagotchi version; it is 5.
– The third is C, the first digit of CharacterCode, so it has value 1x.
– The fourth obviously is 3, our Encryptionkey.
– The fifth is c, the second digit of CharacterCode; it has value 1, so now we know CharacterCode is 11.
– The sixth digit is K, a counter. There’s no use for it except try to avoid people changing data. It’s only the sum of all the other digits. When it reaches 10, it becomes 0 again. Let’s check it: 1+5+1+3+1+1=12 > So it has value 2 (and it’s correct ;))
– The seventh is F, the first digit of FamilyCode; it has value 1, so FamilyCode is now 11.
– The eighth is T, TiesCode and has value 0. I don’t know what does it means.
– The nineth is L, so the first digit of LoginMode. It is always 0 and I don’t know its use.
– The tenth is l, the second digit of LoginMode. It could be not 0, but I don’t know its use.

So, now we know what the Familitchi sent to the site:
– LoginMode: 00
– Version: 5
– CharacterCode: 11
– FamilyCode: 11
– TiesCode: 0
– EncryptionKey: 3
– Counter: 2.

The other keys works in identical way, but the order is scrambled.

And now… what does the server tells the Familitchi?
The way it’s identical, but data are sent in another scrambled way and informations are not the same (obviously… how could it tell our points? :P)

Now… we have this structure:
P = Points (Money are Points x 150)
E = Encoding
K = Counter
X,Y = CharacterCode (2 digits)
V = Tamagotchi’s Version
M = Mode (1 = Get nothing, 2 = Get money)

And the encryption keys organize the data in this way:
Keys 0, 1:
MvKeK x0pyK
Keys 2, 3:
Kvxey KpK0M
Keys 4, 5:
K0vey pMKxK
Keys 6, 7:
vKMe0 xpyKK
Keys 8, 9:
0pKeK vMyKx

You can see there’re *more* counters. Just set one and leave the other as 0.
Another thing you can see is that there’s a 0. It’s only a 0 and I don’t know what does it do.

For example, if I would send to my character (I know my CharacterCode is 11 because I saw it in the code it gave me) 300 dollars, I would create a packet with there informations:
Points (P) = 2
Encoding (E) = 0 (any encryption key is good, I’ll use 0)
CharacterCode = 11
Version (V) = 5
Mode (M) = 2
Counter = To be calculated

So the data is of this type: MVKEK X0PYK.
Let’s fill my data: 25000 1021K. Now let’s calculate K: 2+5+1+2+1=11=1.
So, the code is 25000 10211.

Easy isn’t? ๐Ÿ˜›
Yes… now you know how to cheat with the Tamagotchi ๐Ÿ˜›
Ah… and another thing: yes, codes can be used more than a time ๐Ÿ˜€

PS: Yes, I enjoyed studying it and it’s really *more* cool than sudoku ๐Ÿ˜€
If anyone wants my notes, ask for it ๐Ÿ˜€
I found many informations racking my brain with this page .
Here you can see how the server reads the values and try to figure out what are you sending him.

PPSS: Thanks to Alessandra, the girl who game me her Tamagotchi’s codes ๐Ÿ˜€

5 pensieri su “Tamagotchi v5 Familitchi hack – Codes exploited and revealed!

  1. I got an update from keydre… Tamaexpo logout passwords are based on character type. A logout password can be reused as long you still have that character. The following table are the logout passwords 1000GP prizes. For an English-language V5 or Familitchi model use the character & password table below. Note:Oceania ,N.America,&Europe refere to were tamagotchi was sold. Oceania means australia, Hong kong, taiwan, etc, N.america means USA, canada. Europe means UK etc. Exacample: if you live in USA and bought your v.5 at toys-r-us or wal-mart in your town, you’ll need to use the N.America logout passwords. so enough chit chat here they are:

    CODE
    Character Type OceaniaV.5 N.AmericaV.5 Europe v.5
    Ahirukutchi 21000 10509 22000 10500 23000 10501
    Bakutchi 21000 10587 22000 10588 23000 10589
    Belltchi 21000 10532 22000 10533 23000 10534
    Chamametchi 21000 20500 22000 20501 23000 20502
    Chantotchi 21000 30556 22000 30557 23000 30558
    Furikotchi 21000 20566 22000 20567 23000 20568
    Futabatchi 21000 00564 22000 00565 23000 00566
    Futabatchi 21000 00553 22000 00544 23000 00555
    Gozarutchi 21000 40557 22000 40558 23000 40559
    Hatsugatchi 21000 20577 22000 20578 23000 20579
    Hoshitchi 21000 10554 22000 10555 23000 10556
    Hoshitchi 21000 10565 22000 10566 23000 10567
    Hotteatchi 21000 40535 22000 40536 23000 40537
    Ichigotchi 21000 20511 22000 20512 23000 10590
    Iwatchi 21000 00575 22000 00576 23000 00577
    Iwatchi 21000 00586 22000 00587 23000 00588
    Konoitchi 21000 40568 22000 40569 23000 40560
    Korokotchi 21000 10598 22000 10599 23000 10590
    Kuchipatchi 21000 30523 22000 30524 23000 30525
    Kuromametchi 21000 20588 22000 20589 23000 20580
    lovezukintchi 21000 30578 22000 20579 23000 30570
    makiko 21000 40513 22000 40514 23000 40515
    mamekatchi 21000 10576 22000 10577 23000 10578
    ill give you rest tomorrow

I commenti sono chiusi.