Hacking Save Nintendo WiFi - A project to save online servers for Wii (and DS) games

[uyjulian]

im not sure but i know they will shut it down in the netherlands

source (its in dutch)
http://www.nintendo.nl/Klantenservi...-Nintendo-Wi-Fi-Connection-dienst-859609.html

http://www.nintendo.co.jp/support/information/2014/0227.html for japan.

It only shows nintendo games, not all games, through.

 

[AwesomeMarioFan]

After around 2 hours or so of messing around I got a packet logging setup working using a router I had laying around, and an iPhone.

 

[AwesomeMarioFan]

iPhone Packet Logging Instructions (As Promised):

Note: Only attempt this on your own network, and at your own risk. I am not responsible for any damage to your phone through jailbreaking, installing/using the application or following this guide.

Prerequisites:
- Your iPhone must be Jailbroken before using this. You can do this by using a jailbreak tool listed on this (http://www.idownloadblog.com/download/) page.

Note: The application on your iPhone will pick up packets from any devices on your network, be sure to either disconnect all devices or use an extra router.

This works by doing a MITM (Man In The Middle) attack on your network to trick all devices into sending the packets through your phone, then to the network. It also logs the packets as well.

Step 1: Open up Cydia.
Step 2: Search for Pirni Pro. You should see a listing from The BigBoss repo for $1.99. Search also for iFile, and install both.
Step 3: Once installed, open up Pirni Pro from the SpringBoard.
Step 4: Tap BPF Filter, then backspace everything there and press Return. This will remove the filters and allow us to catch all packets going through the network.
Step 5: Change Dumpfile from /tmp/log.pcap to /var/mobile/log.pcap. (You can also change this to something like /var/mobile/dumps/log.pcap, but make sure you create the directory using iFile if you do this.)
Step 6: If you want to use custom regexes under Regex Options, you can configure these from settings and select them, however I recommend not doing this. (Regexes allow you to see certain data live as it is logged, otherwise it is simply written to the file and you have to either open it in iFile or transfer it to your computer to view it.)
Step 7: Tap Start when you are ready to capture packets. The file will be saved to the directory you typed into the application.

WARNING: Do not leave the directory set to /tmp/log.pcap! When your iPhone ever reboots, this directory is cleared and you will loose all logged data!

To View The File On Your iPhone:
Step 1: Open iFile after logging.
Step 2: Navigate to the directory the file was saved in. Normally this is /tmp/log.pcap, but in this tutorial I recommended using /var/mobile/log.pcap.
Step 3: Tap the arrow next to the file.
Step 4: Select Text Editor, and the file should open up.

To Get The File Transferred To Your Computer:
Step 1: Open up iFile.
Step 2: Tap the Wireless icon towards the bottom left.
Warning: Opening up the wireless connection will allow anyone on your network to connect to your iPhone unless you set a password under Settings in the iFile application.
Step 3: On your computer, navigate to the address displayed on the screen of your iPhone.
Step 4: Navigate to the directory of the saved file. In this tutorial, I suggest /var/mobile/log.pcap.
Step 5: Click the file to download it, then open it up in WireShark. (http://www.wireshark.org/download.html)

That's It, Enjoy!

 

[uyjulian]

http://www.nintendo.co.jp/support/information/2014/0227.html for japan.

It only shows nintendo games, not all games, through.

So, anybody around here know the complete lists for eur, jpn region?

 

[HNKii]

So, anybody around here know the complete lists for eur, jpn region?

Just check for games with the Nintendo Wi-Fi connection logo, any game with these symbols would be affected

 

[Toad King]

iPhone Packet Logging Instructions (As Promised):

Note: Only attempt this on your own network, and at your own risk. I am not responsible for any damage to your phone through jailbreaking, installing/using the application or following this guide.

Prerequisites:
- Your iPhone must be Jailbroken before using this. You can do this by using a jailbreak tool listed on this (http://www.idownloadblog.com/download/) page.

Note: The application on your iPhone will pick up packets from any devices on your network, be sure to either disconnect all devices or use an extra router.

This works by doing a MITM (Man In The Middle) attack on your network to trick all devices into sending the packets through your phone, then to the network. It also logs the packets as well.

Step 1: Open up Cydia.
Step 2: Search for Pirni Pro. You should see a listing from The BigBoss repo for $1.99. Search also for iFile, and install both.
Step 3: Once installed, open up Pirni Pro from the SpringBoard.
Step 4: Tap BPF Filter, then backspace everything there and press Return. This will remove the filters and allow us to catch all packets going through the network.
Step 5: Change Dumpfile from /tmp/log.pcap to /var/mobile/log.pcap. (You can also change this to something like /var/mobile/dumps/log.pcap, but make sure you create the directory using iFile if you do this.)
Step 6: If you want to use custom regexes under Regex Options, you can configure these from settings and select them, however I recommend not doing this. (Regexes allow you to see certain data live as it is logged, otherwise it is simply written to the file and you have to either open it in iFile or transfer it to your computer to view it.)
Step 7: Tap Start when you are ready to capture packets. The file will be saved to the directory you typed into the application.

WARNING: Do not leave the directory set to /tmp/log.pcap! When your iPhone ever reboots, this directory is cleared and you will loose all logged data!

To View The File On Your iPhone:
Step 1: Open iFile after logging.
Step 2: Navigate to the directory the file was saved in. Normally this is /tmp/log.pcap, but in this tutorial I recommended using /var/mobile/log.pcap.
Step 3: Tap the arrow next to the file.
Step 4: Select Text Editor, and the file should open up.

To Get The File Transferred To Your Computer:
Step 1: Open up iFile.
Step 2: Tap the Wireless icon towards the bottom left.
Warning: Opening up the wireless connection will allow anyone on your network to connect to your iPhone unless you set a password under Settings in the iFile application.
Step 3: On your computer, navigate to the address displayed on the screen of your iPhone.
Step 4: Navigate to the directory of the saved file. In this tutorial, I suggest /var/mobile/log.pcap.
Step 5: Click the file to download it, then open it up in WireShark. (http://www.wireshark.org/download.html)

That's It, Enjoy!

Nice guides, but I'm hesitant to put it on my site for two reasons:
1. It requires an app purchase. I would rather a free solution (outside of hardware obviously).
2. More importantly, this is a very invasive hack. Hijacking an entire network just for packet captures of one device (one we have control over) is overkill and very dangerous. Plus, it's not trivial to filter out unnecessary packets, and if users don't filter their captures correctly they can very easily reveal sensitive information accidentally.

 

[AwesomeMarioFan]

I agree with your points, unfortunately I don't know of a better way for iPhones though.
Basically, the way I would do it, is have the Wii setup connected to the router over wireless, and have the router connected to the main router via ethernet.
From the iPhone I would then run the application, filter it on the computer, and export it to a .txt file.

I already have the first dump done by the way. It's a course on Mario Kart Wii, I have the full recording with it too and I'll try to get that uploaded. Unfortunately, it looked like a hacker ended up in the race with me, since it ended on lap 1.

Edit: There's a way to set a filter with the application, there's probably a way to filter it to only show certain traffic to the Wii.
Edit 2: Hmm, WireShark is having a hard time opening it up...
The capture file appears to be damaged or corrupt.
(pcap: File has 3600882676-byte packet, bigger than maximum of 65535)

Opening it up with NotePad I'm finding some cool stuff though:

localip1 190.190.190.190 localport 54390 natneg 1 statechanged 1 gamename mariokartwii publicip 402696839 publicport 54390 numplayers 6 maxplayers 11 dwc_pid 186025922 dwc_mtype 0 dwc_mver 90 dwc_eval 1 dwc_groupid 0 dwc_hoststate 1 dwc_suspend 0 rk vs ev 5343 eb 5223 p 0

I wonder if we can change the maxplayers.

 

[HAARP-GE 007]

It looks like that router has OpenWRT support so if DD-WRT doesn't have the module you have other choices: http://wiki.openwrt.org/toh/tp-link/tl-wr740n

my new router arrived today .TP-Link WR740N version 4.22 , as i am not sure what exact firmware i need and never having flashed a router before i contacted DD-WRT with router details to check if there firmware for that router has ipt_module etc ...but receivedved no answer , could anyone here guide me to what exact firmware i need and possible walkthrough help to get up and running with the flashing etc...if i can get this done and set up i will be able to data record as soon as possible until the servers go down ...any help and time anyone could give me would be appreciated so much ,,, i know i am a noob at this ..but i really believe in this project and want to do my bit to help ...i play Goldeneye daily partied with friends and could capture a lot of data for you

 

[leseratte]

Simply download the Firmware from the dd-wrt-homepage and install it by clicking on "update" in the web interface.

http://www.dd-wrt.com/routerdb/de/download/TP-Link/TL-WR740N/4.x/factory-to-ddwrt.bin/4155

 

[HAARP-GE 007]

Simply download the Firmware from the dd-wrt-homepage and install it by clicking on "update" in the web interface.

http://www.dd-wrt.com/routerdb/de/download/TP-Link/TL-WR740N/4.x/factory-to-ddwrt.bin/4155

so set up the router as normal so everything is working ...open up the router home page and do it from there ?

 

[AwesomeMarioFan]

so set up the router as normal so everything is working ...open up the router home page and do it from there ?

I have been reading about doing this too, be sure to read the installation page on the website for your router model. It's not as simple as doing the reflash from the web interface, there are other steps involved including hard resets, etc.

 

[HAARP-GE 007]

I have managed to get DD-WRT on the new router Firmware version v24-sp2
I have downloaded wireshark and puTTy
here are the things i need help with after reading the instructions here
1: where is the router command line where i would type in "
try running "modprobe ipt_ROUTE" or "insmod ipt_ROUTE" on your router's command line"
2 : how do i set up putty to do what is needed
3 : on the dd-wrt router setting what to i need to enable/disable ...

I've got all the programs downloaded now ...I just need help how to set it up then I'm good to go ...can anyone help please ?????

 

[AwesomeMarioFan]

Yep, I set this up yesterday like you.

Make sure you set up the router in the router settings (http://192.168.1.1).
I recommend changing the following:
- Under the Wireless tab, use:
- Wireless Mode: AP
- Wireless Network Mode: Mixed
- Wireless Network Name (SSID)
- Wireless Channel: 1 - 2.412GHz
- Channel Width: 20 MHz
- Wirless SSID Broadcast - On (For The Wii)
- Network Configuration - I believe Bridged is better here. I have my router hooked up to another one, so I'm not sure if that's what it's referring to.
- Then click the Wireless Security Subtab towards the top
- I recommend setting the Security Mode to WPA2 Personal
- WPA Algorithms: AES
- WPA Shared Key: (Wireless Network Password for Wii)

- Under the Administration tab:
- Verify the password settings
- Enable the HTTPS checkbox for secure connections to the control panel

Open puTTy, and connect to your router. Login with the default username/password (root, [yoursetpassword]).
Enter the following commands into the terminal and press enter:

insmod ipt_ROUTE

This should return nothing. If so, continue.

iptables -t mangle -A PREROUTING -s <DEVICE_IP> -j ROUTE --tee --gw <CAPTURE_PC_IP>
iptables -t mangle -A POSTROUTING -d <DEVICE_IP> -j ROUTE --tee --gw <CAPTURE_PC_IP>

After that, open up Wireshark on your computer and put in this as the filter: "ip.addr == <DEVICE_IP>".
You should now be capturing from the Wii.

 

[HAARP-GE 007]

Yep, I set this up yesterday like you.

Make sure you set up the router in the router settings (http://192.168.1.1).
I recommend changing the following:
- Under the Wireless tab, use:
- Wireless Mode: AP
- Wireless Network Mode: Mixed
- Wireless Network Name (SSID)
- Wireless Channel: 1 - 2.412GHz
- Channel Width: 20 MHz
- Wirless SSID Broadcast - On (For The Wii)
- Network Configuration - I believe Bridged is better here. I have my router hooked up to another one, so I'm not sure if that's what it's referring to.
- Then click the Wireless Security Subtab towards the top
- I recommend setting the Security Mode to WPA2 Personal
- WPA Algorithms: AES
- WPA Shared Key: (Wireless Network Password for Wii)

- Under the Administration tab:
- Verify the password settings
- Enable the HTTPS checkbox for secure connections to the control panel

Open puTTy, and connect to your router. Login with the default username/password (root, [yoursetpassword]).
Enter the following commands into the terminal and press enter:

insmod ipt_ROUTE

This should return nothing. If so, continue.

iptables -t mangle -A PREROUTING -s <DEVICE_IP> -j ROUTE --tee --gw <CAPTURE_PC_IP>
iptables -t mangle -A POSTROUTING -d <DEVICE_IP> -j ROUTE --tee --gw <CAPTURE_PC_IP>

After that, open up Wireshark on your computer and put in this as the filter: "ip.addr == <DEVICE_IP>".
You should now be capturing from the Wii.

Thank you so much for this ...i'll get right to it when my visitors have gone ...this is exactly the kind of instructions i need :-D

 

[HAARP-GE 007]

Thank you so much for this ...i'll get right to it when my visitors have gone ...this is exactly the kind of instructions i need :-D

ive changed the router settings advised, opened putty put in the router ip 192.168.1.1 and i get the message 'cannot connect to device'... so i switched the ssh tab to telnet and it asks me for router login ..when i put in my username and password it tells me login incorrect

 

[Toad King]

There should be a page on the router administrative panel for telnet/SSH settings.

 

[leseratte]

You have to use "root" as username, not the username you specified in the Web-Interface.

 

[AwesomeMarioFan]

Connect with SSH, and use the following:
Username: root
Password: Login specified in web interface. (Not the AP password, the administration password.)

 

[HAARP-GE 007]

Connect with SSH, and use the following:
Username: root
Password: Login specified in web interface. (Not the AP password, the administration password.)

if i try and connect with SSH on putty, it tells me connection refused, if i switch to telnet...it lets me in no problem

 

[HAARP-GE 007]

if i try and connect with SSH on putty, it tells me connection refused, if i switch to telnet...it lets me in no problem

I'm definatley doing something wrong here...i had to log into putty with it clicked on telnet as i said ...i put in the commands there ...opened wireshark , put the router ip in the filter bar, press start ...nothing comes up on the screen when i connect to the wii , and in the bottom left corner of wireshark the capture in progress button turn to red and says error