Toys only store data
Skylanders: Giants character figures
Despite the marketing name of "toys to life," there's no "life" in the toys. While each toy has a unique identifier, there isn't anything else original stored on a figure; all figures for a given game store the same sorts of data in the same places. They are storage devices for numeric and text data that track your character's progress.
Even though most of the data on a given figure is encrypted, once we know the keys A or PWD for a toy, we can view its contents repeatedly, and learn what data might be stored where. Let's do that now, putting a figure on a portal, changing something in the game, then taking the figure off the portal and reading the data to see what we can discover.
Ninjini
Let's start with the Skylanders "Ninjini" figure we looked at earlier, which was introduced for the game Skylanders: Giants. We'll start by erasing it completely, so the game has a completely blank slate when we place it on the portal. That data looks like this:
048b9f382881010fc427000000000012
6d00000070dccb6ed34d00000612f2fe
00000000000000000000000000000000
4b0b20107ccb0f0f0f69000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
edb9a575cc357f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
cbd471261bf67f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
58e29b8ff0177f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
143833285e907f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
870ed981b5717f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
a1630dd262b27f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
3255e77b89537f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
aae1b634d45c7f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
39d75c9d3fbd7f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
1fba88cee87e7f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
8c8c6267039f7f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
c056cac0ad187f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
5360206946f97f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
750df43a913a7f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
e63b1e937adb7f0f0869000000000000
Now, as a standard NFC token, we know each row is a block, every group of four blocks is a sector, and the fourth block in each sector is the trailer, where the key A and access permissions are stored.
We also know from the access permissions in the first sector (which includes the blocks that have the UID and the toy model number) that it's completely locked down, and we can't write to it. Let's fade out all of these standard things, so we can focus on finding interesting data.
048b9f382881010fc427000000000012
6d00000070dccb6ed34d00000612f2fe
00000000000000000000000000000000
4b0b20107ccb0f0f0f69000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
edb9a575cc357f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
cbd471261bf67f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
58e29b8ff0177f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
143833285e907f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
870ed981b5717f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
a1630dd262b27f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
3255e77b89537f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
aae1b634d45c7f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
39d75c9d3fbd7f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
1fba88cee87e7f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
8c8c6267039f7f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
c056cac0ad187f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
5360206946f97f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
750df43a913a7f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
e63b1e937adb7f0f0869000000000000
First writes
When Skylanders: Giants first asks us to put a toy on the portal, it almost immediately writes to it! It changes to this:
048b9f382881010fc427000000000012
6d00000070dccb6ed34d00000612f2fe
00000000000000000000000000000000
4b0b20107ccb0f0f0f69000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
edb9a575cc357f0f0869000000000000
5b00e0d3a691ea9d6a93c93348c35d5f
b893ce40958a66d3faee5c5a8cb15116
3982b1519ae73c4c2e83f19c8545c2c8
cbd471261bf67f0f0869000000000000
0f5dc22225ac4cc829f13c9bb5b945a6
70574d5c8be3164624e04abb9225c0aa
b4fb860161020cd3a69ef8ec2b49db23
58e29b8ff0177f0f0869000000000000
78330690ea993234f430bd9ffbbe4ca2
43968ac84bb0b4099a25a49732a5f831
4d0ab7ac143273852a7797097d402024
143833285e907f0f0869000000000000
2f0b587954b1d9359c3e839e24084a8d
3e9b2242b05332dccd47743fb94ff797
00000000000000000000000000000000
870ed981b5717f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
a1630dd262b27f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
3255e77b89537f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
aae1b634d45c7f0f0869000000000000
5c0ec67a608e97a1bc3253f820b5549c
407c1fdf76b97cbf9f9df6a6251ea3a0
d3cc12b4374fa085a9c82460d38b3484
39d75c9d3fbd7f0f0869000000000000
a643e3ba6683cee88aebb7d5f0716bd2
d1872d944c1e9c11a1a5f9038db96967
ca7f32c64c0ab792e695ccd918a9a58a
1fba88cee87e7f0f0869000000000000
f3268969aad925141a6f476cc01802ae
63873a385286acca7e91c3582823d675
cfbc77e45fb944fb7d3c5ee4aaac50ef
8c8c6267039f7f0f0869000000000000
7d910ce264ad63270e6bb427e1f51ffb
8f7cc6b94dc46470c0fecede3fb8a0b0
00000000000000000000000000000000
c056cac0ad187f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
5360206946f97f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
750df43a913a7f0f0869000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
e63b1e937adb7f0f0869000000000000
Two areas, each with three-and-three-quarter sectors full. Kinda funny that they're the same length; a standard way that NFC tokens store data (in value mode) is to save the same data three times in a row.
In fact, it's a little hard to tell on Giants, but were we testing with the original Skylanders: Spyro's Adventure game, which writes to its toys a little more slowly, we would first see that second area of the figure get written, then the first, and it would ping-pong back and forth. It seems to be a way to help maintain accurate data on the toy in the event of a crash or corruption. That means for our purposes, we can also ignore the whole second area of the figure. Let's cut it out, along with the locked first sector. That leaves us with blocks 04-17 (in hex, starting with 00), or 5-24 (in decimal, starting with 1).
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
edb9a575cc357f0f0869000000000000
5b00e0d3a691ea9d6a93c93348c35d5f
b893ce40958a66d3faee5c5a8cb15116
3982b1519ae73c4c2e83f19c8545c2c8
cbd471261bf67f0f0869000000000000
0f5dc22225ac4cc829f13c9bb5b945a6
70574d5c8be3164624e04abb9225c0aa
b4fb860161020cd3a69ef8ec2b49db23
58e29b8ff0177f0f0869000000000000
78330690ea993234f430bd9ffbbe4ca2
43968ac84bb0b4099a25a49732a5f831
4d0ab7ac143273852a7797097d402024
143833285e907f0f0869000000000000
2f0b587954b1d9359c3e839e24084a8d
3e9b2242b05332dccd47743fb94ff797
00000000000000000000000000000000
870ed981b5717f0f0869000000000000
We'll continue to look at the full hexadecimal content of the blocks, but, practically, because they're encrypted, we could really just compare them and have a grid of fifteen "did this change?" Y/N checkboxes or something. In fact, that's how I tracked these changes originally. Here's my chart tracking sector-level usage of a handful of figures:
And here's my tracking of block-level changes in initial writes in Spyro's Adventure and Giants:
Playtime timer
Anyway, the first thing we're going to do is nothing. We're going to just let Ninjini float there in game, and we'll walk away and come back many minutes later, and see this:
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
edb9a575cc357f0f0869000000000000
78c7c394aa2eda7867af9cd63906659f
b893ce40958a66d3faee5c5a8cb15116
3982b1519ae73c4c2e83f19c8545c2c8
cbd471261bf67f0f0869000000000000
0f5dc22225ac4cc829f13c9bb5b945a6
4914b24c7903b2ef9133882b11d2f51e
b4fb860161020cd3a69ef8ec2b49db23
58e29b8ff0177f0f0869000000000000
78330690ea993234f430bd9ffbbe4ca2
43968ac84bb0b4099a25a49732a5f831
4d0ab7ac143273852a7797097d402024
143833285e907f0f0869000000000000
2f0b587954b1d9359c3e839e24084a8d
3e9b2242b05332dccd47743fb94ff797
00000000000000000000000000000000
870ed981b5717f0f0869000000000000
Let's put that side-by-side and highlight the differences (00:00 playtime on the left, 00:31 playtime on the right):
00000000000000000000000000000000 00000000000000000000000000000000
00000000000000000000000000000000 00000000000000000000000000000000
00000000000000000000000000000000 00000000000000000000000000000000
edb9a575cc357f0f0869000000000000 edb9a575cc357f0f0869000000000000
5b00e0d3a691ea9d6a93c93348c35d5f 78c7c394aa2eda7867af9cd63906659f
b893ce40958a66d3faee5c5a8cb15116 b893ce40958a66d3faee5c5a8cb15116
3982b1519ae73c4c2e83f19c8545c2c8 3982b1519ae73c4c2e83f19c8545c2c8
cbd471261bf67f0f0869000000000000 cbd471261bf67f0f0869000000000000
0f5dc22225ac4cc829f13c9bb5b945a6 0f5dc22225ac4cc829f13c9bb5b945a6
70574d5c8be3164624e04abb9225c0aa 4914b24c7903b2ef9133882b11d2f51e
b4fb860161020cd3a69ef8ec2b49db23 b4fb860161020cd3a69ef8ec2b49db23
58e29b8ff0177f0f0869000000000000 58e29b8ff0177f0f0869000000000000
78330690ea993234f430bd9ffbbe4ca2 78330690ea993234f430bd9ffbbe4ca2
43968ac84bb0b4099a25a49732a5f831 43968ac84bb0b4099a25a49732a5f831
4d0ab7ac143273852a7797097d402024 4d0ab7ac143273852a7797097d402024
143833285e907f0f0869000000000000 143833285e907f0f0869000000000000
2f0b587954b1d9359c3e839e24084a8d 2f0b587954b1d9359c3e839e24084a8d
3e9b2242b05332dccd47743fb94ff797 3e9b2242b05332dccd47743fb94ff797
00000000000000000000000000000000 00000000000000000000000000000000
870ed981b5717f0f0869000000000000 870ed981b5717f0f0869000000000000
Two blocks are different! The only thing we did in-game was idle. What if we keep idling a few more minutes?
(00:00 playtime, 00:31 playtime, 00:34 playtime)
00000000000000000000000000000000 00000000000000000000000000000000 00000000000000000000000000000000
00000000000000000000000000000000 00000000000000000000000000000000 00000000000000000000000000000000
00000000000000000000000000000000 00000000000000000000000000000000 00000000000000000000000000000000
edb9a575cc357f0f0869000000000000 edb9a575cc357f0f0869000000000000 edb9a575cc357f0f0869000000000000
5b00e0d3a691ea9d6a93c93348c35d5f 78c7c394aa2eda7867af9cd63906659f efe969b9c7d277b7fbde4598e65f2b63
b893ce40958a66d3faee5c5a8cb15116 b893ce40958a66d3faee5c5a8cb15116 b893ce40958a66d3faee5c5a8cb15116
3982b1519ae73c4c2e83f19c8545c2c8 3982b1519ae73c4c2e83f19c8545c2c8 3982b1519ae73c4c2e83f19c8545c2c8
cbd471261bf67f0f0869000000000000 cbd471261bf67f0f0869000000000000 cbd471261bf67f0f0869000000000000
0f5dc22225ac4cc829f13c9bb5b945a6 0f5dc22225ac4cc829f13c9bb5b945a6 0f5dc22225ac4cc829f13c9bb5b945a6
70574d5c8be3164624e04abb9225c0aa 4914b24c7903b2ef9133882b11d2f51e c57971fb41d5ebc340dc92cc072640ff
b4fb860161020cd3a69ef8ec2b49db23 b4fb860161020cd3a69ef8ec2b49db23 b4fb860161020cd3a69ef8ec2b49db23
58e29b8ff0177f0f0869000000000000 58e29b8ff0177f0f0869000000000000 58e29b8ff0177f0f0869000000000000
78330690ea993234f430bd9ffbbe4ca2 78330690ea993234f430bd9ffbbe4ca2 78330690ea993234f430bd9ffbbe4ca2
43968ac84bb0b4099a25a49732a5f831 43968ac84bb0b4099a25a49732a5f831 43968ac84bb0b4099a25a49732a5f831
4d0ab7ac143273852a7797097d402024 4d0ab7ac143273852a7797097d402024 4d0ab7ac143273852a7797097d402024
143833285e907f0f0869000000000000 143833285e907f0f0869000000000000 143833285e907f0f0869000000000000
2f0b587954b1d9359c3e839e24084a8d 2f0b587954b1d9359c3e839e24084a8d 2f0b587954b1d9359c3e839e24084a8d
3e9b2242b05332dccd47743fb94ff797 3e9b2242b05332dccd47743fb94ff797 3e9b2242b05332dccd47743fb94ff797
00000000000000000000000000000000 00000000000000000000000000000000 00000000000000000000000000000000
870ed981b5717f0f0869000000000000 870ed981b5717f0f0869000000000000 870ed981b5717f0f0869000000000000
Looks like there's some sort of playtime timer being tracked there!
Nicknames
Let's do something else that doesn't require actually playing the game: setting our nickname. By default, the nickname is the character name: Ninjini.
Let's change it to "Securitoy" and see what changes.
("Ninjini" on the left, "Securitoy" on the right)
00000000000000000000000000000000 00000000000000000000000000000000
00000000000000000000000000000000 00000000000000000000000000000000
00000000000000000000000000000000 00000000000000000000000000000000
edb9a575cc357f0f0869000000000000 edb9a575cc357f0f0869000000000000
efe969b9c7d277b7fbde4598e65f2b63 33221aade2316dfd5c68b62a46c7e911
b893ce40958a66d3faee5c5a8cb15116 b893ce40958a66d3faee5c5a8cb15116
3982b1519ae73c4c2e83f19c8545c2c8 b6b1cc7a0cb42f27ea5904cfefa9d17b
cbd471261bf67f0f0869000000000000 cbd471261bf67f0f0869000000000000
0f5dc22225ac4cc829f13c9bb5b945a6 dad957d41b2b6bb12b34c32a77f92335
70574d5c8be3164624e04abb9225c0aa aa649ef00de18bf1c89792937927929e
b4fb860161020cd3a69ef8ec2b49db23 b4fb860161020cd3a69ef8ec2b49db23
58e29b8ff0177f0f0869000000000000 58e29b8ff0177f0f0869000000000000
78330690ea993234f430bd9ffbbe4ca2 78330690ea993234f430bd9ffbbe4ca2
43968ac84bb0b4099a25a49732a5f831 43968ac84bb0b4099a25a49732a5f831
4d0ab7ac143273852a7797097d402024 4d0ab7ac143273852a7797097d402024
143833285e907f0f0869000000000000 143833285e907f0f0869000000000000
2f0b587954b1d9359c3e839e24084a8d 2f0b587954b1d9359c3e839e24084a8d
3e9b2242b05332dccd47743fb94ff797 3e9b2242b05332dccd47743fb94ff797
00000000000000000000000000000000 00000000000000000000000000000000
870ed981b5717f0f0869000000000000 870ed981b5717f0f0869000000000000
Giants will only let us enter in names up to 15 letters long. If both of those blocks are 100% dedicated to the nickname, that means there's 32 bytes available for it, but a 15-character limit suggests something more like two bytes per character, possibly to support foreign language characters in Unicode. "Securitoy" is nine characters, so 18 bytes, so it would take up the whole first block and then two bytes in the second block.
Let's set it to a short nickname, like "bob" and see if we're right.
(Ninjini, Securitoy, bob)
00000000000000000000000000000000 00000000000000000000000000000000 00000000000000000000000000000000
00000000000000000000000000000000 00000000000000000000000000000000 00000000000000000000000000000000
00000000000000000000000000000000 00000000000000000000000000000000 00000000000000000000000000000000
edb9a575cc357f0f0869000000000000 edb9a575cc357f0f0869000000000000 edb9a575cc357f0f0869000000000000
efe969b9c7d277b7fbde4598e65f2b63 33221aade2316dfd5c68b62a46c7e911 1d732b75d33aff25f2675c9b44ef1fbb
b893ce40958a66d3faee5c5a8cb15116 b893ce40958a66d3faee5c5a8cb15116 b893ce40958a66d3faee5c5a8cb15116
3982b1519ae73c4c2e83f19c8545c2c8 b6b1cc7a0cb42f27ea5904cfefa9d17b be08da56d4294d3a3cea3d462bbab45e
cbd471261bf67f0f0869000000000000 cbd471261bf67f0f0869000000000000 cbd471261bf67f0f0869000000000000
0f5dc22225ac4cc829f13c9bb5b945a6 dad957d41b2b6bb12b34c32a77f92335 0f5dc22225ac4cc829f13c9bb5b945a6
70574d5c8be3164624e04abb9225c0aa aa649ef00de18bf1c89792937927929e b77b34ce26cb9bd4e6fef26750d59a5b
b4fb860161020cd3a69ef8ec2b49db23 b4fb860161020cd3a69ef8ec2b49db23 b4fb860161020cd3a69ef8ec2b49db23
58e29b8ff0177f0f0869000000000000 58e29b8ff0177f0f0869000000000000 58e29b8ff0177f0f0869000000000000
78330690ea993234f430bd9ffbbe4ca2 78330690ea993234f430bd9ffbbe4ca2 78330690ea993234f430bd9ffbbe4ca2
43968ac84bb0b4099a25a49732a5f831 43968ac84bb0b4099a25a49732a5f831 43968ac84bb0b4099a25a49732a5f831
4d0ab7ac143273852a7797097d402024 4d0ab7ac143273852a7797097d402024 4d0ab7ac143273852a7797097d402024
143833285e907f0f0869000000000000 143833285e907f0f0869000000000000 143833285e907f0f0869000000000000
2f0b587954b1d9359c3e839e24084a8d 2f0b587954b1d9359c3e839e24084a8d 2f0b587954b1d9359c3e839e24084a8d
3e9b2242b05332dccd47743fb94ff797 3e9b2242b05332dccd47743fb94ff797 3e9b2242b05332dccd47743fb94ff797
00000000000000000000000000000000 00000000000000000000000000000000 00000000000000000000000000000000
870ed981b5717f0f0869000000000000 870ed981b5717f0f0869000000000000 870ed981b5717f0f0869000000000000
The second block goes back to what it was when the nickname was "Ninjini"! We're probably right.
Gold and/or XP
Let's reset our nickname and play a little of the game, see if we can track gold or experience.
Here's playing just for a moment and earning 10 gold:
(0 gold on the left, 10 gold on the right)
00000000000000000000000000000000 00000000000000000000000000000000
00000000000000000000000000000000 00000000000000000000000000000000
00000000000000000000000000000000 00000000000000000000000000000000
edb9a575cc357f0f0869000000000000 edb9a575cc357f0f0869000000000000
efe969b9c7d277b7fbde4598e65f2b63 c10c9917b7cca1505bcb88c40479fe90
b893ce40958a66d3faee5c5a8cb15116 b893ce40958a66d3faee5c5a8cb15116
3982b1519ae73c4c2e83f19c8545c2c8 3982b1519ae73c4c2e83f19c8545c2c8
cbd471261bf67f0f0869000000000000 cbd471261bf67f0f0869000000000000
0f5dc22225ac4cc829f13c9bb5b945a6 0f5dc22225ac4cc829f13c9bb5b945a6
70574d5c8be3164624e04abb9225c0aa 419335db4cf15ec339c62403c0921f87
b4fb860161020cd3a69ef8ec2b49db23 b4fb860161020cd3a69ef8ec2b49db23
58e29b8ff0177f0f0869000000000000 58e29b8ff0177f0f0869000000000000
78330690ea993234f430bd9ffbbe4ca2 78330690ea993234f430bd9ffbbe4ca2
43968ac84bb0b4099a25a49732a5f831 43968ac84bb0b4099a25a49732a5f831
4d0ab7ac143273852a7797097d402024 4d0ab7ac143273852a7797097d402024
143833285e907f0f0869000000000000 143833285e907f0f0869000000000000
2f0b587954b1d9359c3e839e24084a8d 2f0b587954b1d9359c3e839e24084a8d
3e9b2242b05332dccd47743fb94ff797 3e9b2242b05332dccd47743fb94ff797
00000000000000000000000000000000 00000000000000000000000000000000
870ed981b5717f0f0869000000000000 870ed981b5717f0f0869000000000000
Huhn. There aren't any new differences.
Let's earn a bunch more gold.
(0 gold, 10 gold, 383 gold)
00000000000000000000000000000000 00000000000000000000000000000000 00000000000000000000000000000000
00000000000000000000000000000000 00000000000000000000000000000000 00000000000000000000000000000000
00000000000000000000000000000000 00000000000000000000000000000000 00000000000000000000000000000000
edb9a575cc357f0f0869000000000000 edb9a575cc357f0f0869000000000000 edb9a575cc357f0f0869000000000000
efe969b9c7d277b7fbde4598e65f2b63 c10c9917b7cca1505bcb88c40479fe90 5e6f94dd891779642da4faa97f7d275a
b893ce40958a66d3faee5c5a8cb15116 b893ce40958a66d3faee5c5a8cb15116 b893ce40958a66d3faee5c5a8cb15116
3982b1519ae73c4c2e83f19c8545c2c8 3982b1519ae73c4c2e83f19c8545c2c8 3982b1519ae73c4c2e83f19c8545c2c8
cbd471261bf67f0f0869000000000000 cbd471261bf67f0f0869000000000000 cbd471261bf67f0f0869000000000000
0f5dc22225ac4cc829f13c9bb5b945a6 0f5dc22225ac4cc829f13c9bb5b945a6 0f5dc22225ac4cc829f13c9bb5b945a6
70574d5c8be3164624e04abb9225c0aa 419335db4cf15ec339c62403c0921f87 006490a30d7a5756424a3e17ca04603f
b4fb860161020cd3a69ef8ec2b49db23 b4fb860161020cd3a69ef8ec2b49db23 b4fb860161020cd3a69ef8ec2b49db23
58e29b8ff0177f0f0869000000000000 58e29b8ff0177f0f0869000000000000 58e29b8ff0177f0f0869000000000000
78330690ea993234f430bd9ffbbe4ca2 78330690ea993234f430bd9ffbbe4ca2 78330690ea993234f430bd9ffbbe4ca2
43968ac84bb0b4099a25a49732a5f831 43968ac84bb0b4099a25a49732a5f831 2d93b86788d89d9595e416adce75238e
4d0ab7ac143273852a7797097d402024 4d0ab7ac143273852a7797097d402024 9601bfb99c07e369a272ff8295d5677a
143833285e907f0f0869000000000000 143833285e907f0f0869000000000000 143833285e907f0f0869000000000000
2f0b587954b1d9359c3e839e24084a8d 2f0b587954b1d9359c3e839e24084a8d 2f0b587954b1d9359c3e839e24084a8d
3e9b2242b05332dccd47743fb94ff797 3e9b2242b05332dccd47743fb94ff797 3e9b2242b05332dccd47743fb94ff797
00000000000000000000000000000000 00000000000000000000000000000000 00000000000000000000000000000000
870ed981b5717f0f0869000000000000 870ed981b5717f0f0869000000000000 870ed981b5717f0f0869000000000000
The trouble with just playing the game for this sort of research, is once enemies start appearing, you don't only earn gold, you also earn experience. You have to be very careful to only increment the variable you're testing.
Here's more gold, with no further experience increase.
(10 gold, 383 gold, 403 gold)
00000000000000000000000000000000 00000000000000000000000000000000 00000000000000000000000000000000
00000000000000000000000000000000 00000000000000000000000000000000 00000000000000000000000000000000
00000000000000000000000000000000 00000000000000000000000000000000 00000000000000000000000000000000
edb9a575cc357f0f0869000000000000 edb9a575cc357f0f0869000000000000 edb9a575cc357f0f0869000000000000
c10c9917b7cca1505bcb88c40479fe90 5e6f94dd891779642da4faa97f7d275a e8c53fe93a94832139f37d03038b3edb
b893ce40958a66d3faee5c5a8cb15116 b893ce40958a66d3faee5c5a8cb15116 b893ce40958a66d3faee5c5a8cb15116
3982b1519ae73c4c2e83f19c8545c2c8 3982b1519ae73c4c2e83f19c8545c2c8 3982b1519ae73c4c2e83f19c8545c2c8
cbd471261bf67f0f0869000000000000 cbd471261bf67f0f0869000000000000 cbd471261bf67f0f0869000000000000
0f5dc22225ac4cc829f13c9bb5b945a6 0f5dc22225ac4cc829f13c9bb5b945a6 0f5dc22225ac4cc829f13c9bb5b945a6
419335db4cf15ec339c62403c0921f87 006490a30d7a5756424a3e17ca04603f 3a6f8b5efc773d7747709a4fd68ffa44
b4fb860161020cd3a69ef8ec2b49db23 b4fb860161020cd3a69ef8ec2b49db23 b4fb860161020cd3a69ef8ec2b49db23
58e29b8ff0177f0f0869000000000000 58e29b8ff0177f0f0869000000000000 58e29b8ff0177f0f0869000000000000
78330690ea993234f430bd9ffbbe4ca2 78330690ea993234f430bd9ffbbe4ca2 78330690ea993234f430bd9ffbbe4ca2
43968ac84bb0b4099a25a49732a5f831 2d93b86788d89d9595e416adce75238e 2d93b86788d89d9595e416adce75238e
4d0ab7ac143273852a7797097d402024 9601bfb99c07e369a272ff8295d5677a 9601bfb99c07e369a272ff8295d5677a
143833285e907f0f0869000000000000 143833285e907f0f0869000000000000 143833285e907f0f0869000000000000
2f0b587954b1d9359c3e839e24084a8d 2f0b587954b1d9359c3e839e24084a8d 2f0b587954b1d9359c3e839e24084a8d
3e9b2242b05332dccd47743fb94ff797 3e9b2242b05332dccd47743fb94ff797 3e9b2242b05332dccd47743fb94ff797
00000000000000000000000000000000 00000000000000000000000000000000 00000000000000000000000000000000
870ed981b5717f0f0869000000000000 870ed981b5717f0f0869000000000000 870ed981b5717f0f0869000000000000
Gold increased, but experience didn't, and those two new blocks didn't change, either.
That probably means gold is tracked in one of the timer update blocks, and experience is tracked in the new blocks. There's room for 16 bytes of data in each block; tracking time doesn't have to take that much, there'd be room for potentially many other variables in each of these.
Advice
Being careful about changing things in game and you can figure out which blocks are likely to store many of your character's variables.
Remember, too, that different games in the series may store different/additional data in different places! But, because every Skylanders figure so far is forward-compatible, something you learn on one figure for one game should carry forward to other figures in future games.