Just wanted to share some information regarding the Tonies.
Tonies are using an NXP ICODE SLIX-L chip which is set into privacy mode. To enable or disable the privacy mode, the 4 Byte long password has to be known which is set by Boxine (company that sells the Toniebox)
For unlocking of any Tonie without to know the password or any fancy Hardware you could use the „knock method“ („Klopf Methode“) which I describe in detail in my blog.
The Toniebox itself verifies the the card by the following steps:
- request random number
- disable privacy mode by set password with Tonie PW, or if not successfull with the default password by NXP „0F0F0F0F“
- read Inventory (checks the first three bytes to be „E0 04 03“
- read 32 Byte memory
- enable privacy mode
- read random number in selected mode (the last step is done over and over again, until the card is taken from the reader)
Due to the verification of the first three Bytes for cloning a tonie you can only use SLIX-L chips or SLIX2 WITH a changeable UID. But the last option is unknown to me because I have not seen any SLIX2 cards with a changeable UID (there are only SLIX cards available but they are missing the privacy mode).
Because the SLIX-L chips do not have a changeable UID you can not fully clone a tonie, but you can use this chip either ways.
Within the toniebox there is a microSD card, where the audiofiles for the audio books are stored. And the name of the audio file in combination with the name of the directory states the UID of the tonie that the audio content is for. By renaming the audifile with the first four bytes of the UID of your new tag in reverse order and naming the directory by the last four bytes of the UID in reverse order.
With this change you can just use any SLIX-L tag to play your audio book.
You do not need to make any modification to the standard SLIX-L tag, because the toniebox is accepting the default password for privacy mode by NXP. And the 32byte memory is only used for downloading the audio file from the tonie server, but because the files of your audio books are already on your toniebox you do not need the memory.
I just wanted to share my findings with you.
Regards,
Gambrius
I used one of the iso15693 cards with the changeable uid feature.
But after setting the uid to the one of my „Kreativtonie“ and set the first 8 Blocks to the same datacontent as my Tonie it did not work on the toniebox. I guess it is the missing privacymode that i do not get to work.
What do you think?
Regards,
Gambrius
Has anyone had any luck so far?
]]>BTW: In active communication, I didn't get the unlocking of a tonie be done by pm3, due the pm3 did not maintain the reader field after sending a command, see my other topic in ISO15639... I do this with a QR-15 fom http://www.metratec.com/ now.
In the meantime I was able to readout some more Tonies, especially two "identical" ones. (Reading works also on tonies in their original packaging... :-) )
Unfortunately, they differ in both, UID and data. The data does not have any conspicuous structure i can see right now... (I still believe it's a sha256 hash over Tokens UID and a secret")
I will also have to search and read the data sheet again.
If I find out more too, you'll hear from me.
]]>Sometimes, reenabling the privacy mode seem to fail - this is the case when the "Tonie" responds to the INV send by your smartphone... If you put the tonie onto the box, you have a good chance that the box locks the Tonie at this time correctly and it will no longer respond to your smartphones INV requests afterwards :-)
Its quite easy to get the privacy mode password by sniffing the communication... With this you can script your own reader and readout the tonies without the box... (Don't do this in the next shop
You will find 32Byte of data in the SLIX-L.
This could be either a SHA256 hash, being a signature of the UID, being just the hash of the content to be downloaded, a internal serialnumber etc.
If I find the time I will read some more of them (I am specially interested in reading 2 similar tonies...), maybe I find out something more...
]]>]]>Got a link?