Audiocube FABA-Box in France, Italy and Spain

[tintifaxe]

Hi, I have come across a FABA box which is made by the same company as the lidl storyland and Migros story boxes. A few things are slightly different compared to the Migros box. The Files are named CP##.mki, and each folder on the SD card has a 72kb file named CP01.MKI. Also, the figurine tags seem to be NTAG213.
Although the .mki Files seem to be XOR encoded, I can not decode them into working .mp3.
I would highly appreciate your help decoding those audio files to be able to replace them with my own audio files.
I have attached a few files from the box and hope you can help me out.

[tintifaxe]

I just successfully decrypted the mp3 files on the FABA box.
It is a Bit rotation +3 followed by XOR 0x06,0xA0,0x23,0x04 (similar to the Lidl Box)
next step is to encrypt own mp3 files and to make on NFC tags work

[oyooyo]

Hi @tintifaxe , thanks for reporting this. Since you've already analyzed the encryption, adding support for this box should be easy. But I would like to have at least one of these encrypted .mki files to test that the encryption/decryption works correctly.
Is it possible to download one of these files somewhere?

[tintifaxe]

Hi, I have uploaded my key file and two example audio files (link will be available for one week): https://we.tl/t-Ya0IjKX67o

The codes on the tags have this format 02190530001500 with the numbers in bold corresponding tho the folder on the box.

Let me know if you need something else.

[Hug0x0]

Hello guyz! I am currently looking at this topic. Do you still have an example audio files plz ?
Thx a lot

[tintifaxe]

I uploaded the key file for the sm2mp3 software (https://github.com/ZapDissaster/smp2mp3/) and one encrypted mki file

[riccardodl]

Hey, the file transfer has expired, would you be able to fork the repo or maybe open a PR onto the original repo, so that I can at least get said key file?

[tintifaxe]

Fbox.zip

Here is the Keyfile (Fbox.key) and on the screenshot the algorithm as set in smp2mp3

Conversion only works in "directory mode"