Custom Tamagotchi 4U Living Space

eth3real
Babytchi
eth3real
Babytchi
Joined: 2:24 AM - May 21, 2016

3:35 AM - May 22, 2016 #1

First of all, hello everyone! This is my first real post, and I hope you all find it interesting.
Admins, I hope this is in the correct spot, please move if needed. ^__^

This guide is fairly technical, but I will try to walk you through every step of the process. :)

You will need:
• A compatible Android device (I used Nexus 5 and 5X)
• Mr.Blinky's 4U English App (http://mrblinky.net/tama/4u/app/)
• Binary's iDmakeDL utility (http://tama-zone.com/index.php?showtopic=23913)
• An intercepting proxy (I used Burp Suite Free edition, https://portswigger.net/burp/downloadfree.html)
• An image editor (I used mspaint, included with Windows)
• A text editor (I used Notepad++, https://notepad-plus-plus.org/)
• A base64 encoder/decoder (I used the MIME Tools plugin in Notepad++)
• A hex editor (I used HxD, https://mh-nexus.de/en/hxd/)

If you have a Tamagotchi 4U and haven't tried Mr.Blinky's English App for Android yet, I highly recommend it. While playing around with this app, I was curious how I could send my own custom content to my Tamagotchi, and succeeded in sending custom living spaces.

Prepare an Image using Binary's iDmakeDL Utility

1. First prepare your image in an image editor such as mspaint. The image will need to be exactly 128 pixels wide by 72 pixels high, and no more than 16 colors. You will need to save the image as a 16-color Bitmap (<filename>.BMP) when you are finished.


Note: It seems like GIMP will sometimes mess up the image. My first test with GIMP came out perfectly, but every one after that came out black.

2. Download and unzip Binary's iDmakeDL utility from http://tama-zone.com/index.php?showtopic=23913. If the download links aren't working, we may need to convince Binary to upload the files to a different location. ;)

3. Once unzipped, launch iDmakeDL.exe. On the top-right, we'll select "create new" "Tamagotchi P's" "Living room Wallpaper".


4. Now click the black box on the right, and click "Load". We'll select our BMP image here.


5. Now click the transparent box on the left, and click "Grab". If your image looks black or wrong in any way, there is a problem with your BMP. Best fix here is to open your BMP in mspaint, and save it as a 16-color BMP to a new file. Restart from step 3 to make sure your new image works.


Note: As you can see, my white turned to a slightly off-white, and my green changed to the same color (however, these were correct when sent to the 4U). Experiment with colors and make sure yours comes out the way you expect in this preview window.

6. You may assign a new catalog name and other variables if you like, but they will take some special attention to get them to work properly. I will be trying to code a utility to make this easier in the future.

7. Finally, click the "your file name" box, and "Save". This will save your image as a JPG image, but we'll only be using a portion of the data in the following steps.


Setup Burp Suite

1. On your PC, navigate to https://portswigger.net/burp/downloadfree.html and the download will start automatically. You will need a Java Runtime Environment (JRE) to run the application.

2. Start a new temporary project (your only option with Burp Suite Free Edition), and then select for settings use the defaults. It will still take a little bit more setup before the proxy is ready to use.

3. First, you'll want to go to Tartget -> Scope, and click "Add" under "Include in scope". The Host will be "mrblinky.net", and the File will be "dlitem.php". This will make sure our proxy doesn't capture unnecesary data.


4. Then, under Proxy -> Options, click "Add" under "Proxy Listeners". You'll need to set the "Bind to port:" to something of your choosing, I typically use "8080". Under "Bind to address:", you'll need to choose an IP that is on your home network, which should be the same as your phone. This should be the first option in the list.


5. While we're on this page, we'll make a couple of other changes as well. Under "Intercept Client Requests", check the box next to "And URL Is in target scope". Under "Intercept Server Responses", change the condition value of "Content type header Matches text" from "text" to "json", and also check "And URL Is in target scope".


6. On your Android device, you will need configure it to use your Burp Suite proxy. This may vary between devices, but mine was in the WiFi menu for my access point. Set it to use the IP address from Burp Suite as the Proxy Host, and the port you chose (8080 if you're following along). Until this setting is later removed, some applications and data that use your WiFi for internet may stop working.

Install Mr.Blinky's 4U English App

1. On your phone, use your browser to navigate to http://mrblinky.net/tama/4u/app/, and click the download link under "Where can I get it ?". After downloading, install the app. You may need to go into your Android Security settings to allow apps to be installed from "unknown sources".

Final Data Preparation

The next couple of steps will be the most difficult, but again, I will try to make this as easy as possible.

1. Start the 4U English app, and go to a Custom Living at the bottom. Choose any one, and press "4U DOWNLOAD". If the proxy is working correctly, you will see the Proxy Intercept window blink and prompt you to "forward" or "drop" the request.

2. The request will start with "POST /4u-app/dlitem.php", but this is not the portion we're interested in. Press "Forward" to continue.

3. The response is what actually has the information that will be transferred to the Tamagotchi, and this is where we will inject our custom image.

4. The response will look something like this (snipped for brevity):
{"rcode":"0","rmes":"","retry":"0","cd":"cliv0092","result":"1","bin":"VEFN<...snip...>=="}
Everything from VEF to == is what we are interested in, copy this entire portion into your text editor.

5. First thing we need to do now is search for any places that have the text "&#092;/" and change it to "/". The reason for this is that the forward slash (/) usually has to be escaped in Linux operating systems, accomplished by adding a backslash to the front of it. Since this is base64 encoded data, we'll have trouble decoding it with the blackslashes in there, as this is not a valid character in base64 encoding. A Find and Replace All will make quick work of this task.


6. Next, we need to base64-decode the text. This will change it from base64 encoding, which browsers and web servers understand very well, to binary data, which is used by computers. To do this, we can select all (Ctrl+A) in Notepad++, then go to Plugins, MIME Tools, and Base64 Decode.


7. Save this file, and open it in HxD. This will be used as the basis for our custom file.

8. On the line marked 200, you'll see in the hex view the following pattern: "00 01 FF". Delete everything this pattern.



9. Still using HxD, open the JPG image created from iDmakeDL. Search for the text "TAMAGO", as it will lead us to the beginning of the data we need.


10. Shortly after that, we should see the same pattern as above, "00 01 FF". This time, we will delete everything BEFORE the pattern, and also the pattern itself. Your data here will be very different from mine, but use the patterns mentioned to make sure you are on track.



11. Now copy all of the data from our custom image, and paste it into the previous text file.


12. Save this file (not the JPG), and close HxD.

13. Nearing the end, we will now have to re-encode the binary data into base64. Open the file again in Notepad++, select all (Ctrl+A), and then go to Plugins, MIME Tools, and Base64 Encode.


14. Do another Search and Replace All, this time changing all instances of "/" to "&#092;/", to make sure that the Android application is happy with the data we're about to inject.


15. Select all of the data, and copy it to the clipboard.

Finishing the Tranfer

1. By now, the connection has likely failed within the 4U English app, and the app may have crashed. This is no problem.

2. If there is still a Forward/Drop transaction waiiting within Burp Suite, drop it.

3. In the 4U English app, browse back to a custom wallpaper, and press 4U DOWNLOAD again.

4. Forward the request, just like we did before.

5. This time, on the response, paste your custom data over the space we used before (everything from "VEFN" to "=="), and forward the response.

6. Use the app the transfer the data as usual. When the transfer is complete and you go to use the new wallpaper, it will be your custom wallpaper instead of the one from the app.

Cleaning Up

1. When you're all done, make sure you set your Android device back to NOT using the proxy!

Finished!

Okay, I know that was a lot of work, but like I said, I am working on a way to make this easier. Until that happens, this will get your custom wallpapers onto your Tamagotchi 4U! With a bit of work, this could potentially also be applied to creating new toys, food, characters, and even games (really any data which can be transferred using NFC normally).

Any comments/questions/suggestions are welcome, I hope you find this useful (or at least interesting). :)
Quote
Like
Share

eth3real
Babytchi
eth3real
Babytchi
Joined: 2:24 AM - May 21, 2016

8:54 PM - May 22, 2016 #2

I've edited the main post to reflect a few edits:

Edit 1: I originally said to use GIMP, but it actually only worked for me the first one or two times. Then I realized that there are plenty of other threads saying NOT to use GIMP, but mspaint works just fine. I had the best results by exporting BMP from GIMP using Indexed 16 colors Bitmap, and then opening it in mspaint and saving it again as 16-color Bitmap.

Edit 2: I'm not sure that it matters which type of device you make the wallpaper for, iD L and P's seem to come out exactly the same.

And the final result:



Quote
Like
Share