The Skylander system has several cryptographic weaknesses:
As a result, tools like SkyBuilder and SkyManager can create “impossible” figures (e.g., level 100 with no upgrades) that still function on console – though online leaderboards may flag them.
The Skylanders .bin format is a simple but cleverly obfuscated structure relying on proprietary checksums and portal challenges. We provide a complete mapping, tools for extraction/modification, and demonstrate emulation. This work enables fan preservation and emulation projects (e.g., RPCS3 integration). Future work: Trap Team’s “Trap” .bin format and Disney Infinity .bin comparison.
A raw Skylander .bin dump consists of multiple pages (4 bytes per page, 4 pages per block on NTAG203). However, the logical mapping is custom.
| Offset (bytes) | Size | Purpose | Exclusive Feature | |----------------|------|---------|--------------------| | 0x00 – 0x03 | 4 | UID + manufacturer info | Standard NFC | | 0x04 – 0x07 | 4 | Lock bytes (static) | Activision custom lock bits | | 0x08 – 0x0F | 8 | Encrypted figure data header | Rolling XOR key A | | 0x10 – 0x1F | 16 | Owner ID + console salt | XOR + SHA-1 hash | | 0x20 – 0x7F | 96 | Encrypted stats (Level, Gold, XP) | XOR key B (derived from UID) | | 0x80 – 0xFF | 128 | Hat/upgrades + quest flags | Simple XOR + checksum | | 0x100 – 0x1FF | 256 | Swap Force top/bottom data | Custom bitfields | | 0x200+ | varies | Traptanium crystal or creation crystal data | Unique encoding | skylander bin files exclusive
The term "exclusive" in the context of .bin files usually falls into three distinct categories:
After decryption and extraction, the .bin payload is structured as follows (480-byte example):
| Offset | Length | Field | Description |
|--------|--------|-------|-------------|
| 0x00 | 2 | Magic | Always 0xCD 0xAB (little-endian: 0xABCD) |
| 0x02 | 2 | Version | Format version (0x0001 for SSA, 0x0004 for Imaginators) |
| 0x04 | 20 | Encrypted Body | Owner name, XP, upgrades (see §4) |
| 0x18 | 1 | Checksum Type | 0x01 = XOR-8, 0x02 = CRC-16 |
| 0x19 | 2 | Checksum | Over offsets 0x00–0x18 (depends on type) |
| 0x1B | 1 | Figure Variant | 0x00 = normal, 0x01 = legendary, 0x02 = dark, etc. |
| 0x1C | 52 | Nickname (UTF-16) | User-assigned name |
| 0x50 | 428 | Encrypted Figure Data | Stats, hats, quest progress, skill tree |
Note: 960-byte files double the above blocks, with separate sections for each half of a SWAPper or Crystal. The Skylander system has several cryptographic weaknesses:
The distribution of exclusive .bin files is a gray area that sparks intense debate within the community.
On one side are the Preservationists. They argue that as physical NFC chips degrade over time (a phenomenon known as "bit rot"), the data on them is lost forever. If a rare Employee Exclusive figure’s chip dies, that digital signature is gone forever. They argue that archiving these .bin files is necessary to keep the game's history alive, especially since the servers are down and the toys are out of production.
On the other side are the Purists. They argue that scanning and distributing .bin files of figures you do not own is software piracy. For them, the value of the "Employee Exclusive" .bin is diminished because it wasn't earned or purchased; it was stolen from the original owner. Furthermore, loading these files often requires a "Portal Emulator" (software that tricks the game into thinking a physical portal is connected), which bypasses the intended hardware experience.
Even with the right files, things go wrong. As a result, tools like SkyBuilder and SkyManager
Error: "This character belongs to another player."
Error: Figure resets to Level 1 after every play session.
Error: Portal doesn't recognize the tag.