Hacking Save Nintendo WiFi - A project to save online servers for Wii (and DS) games

[Toad King]

I've finished work on a NoSSL patching method for Wii games. It can be found here: http://save-nintendo-wifi.com/wii-nossl.html

If you create packet dumps for Wii games in the future I recommend you use it so better dumps can be made. Please tell me if you find any bugs.

 

[AwesomeMarioFan]

Thanks for posting, trying this out now.

Edit: Is it fine if we redirect the DNS somewhere else and log it from there? So that I can upload the files.

 

[Toad King]

Thanks for posting, trying this out now.

Edit: Is it fine if we redirect the DNS somewhere else and log it from there? So that I can upload the files.

You would have to set up your own SSL tunnel and add in tunnels for all the different servers used.

 

[AwesomeMarioFan]

You would have to set up your own SSL tunnel and add in tunnels for all the different servers used.

Ah, WireShark tunneling would not work for this purpose?

Also, for anyone looking for a WAD version of this: http://www.awesomemariofan.com/files/wii/NoSSL-2475.wad
Edit2: Hmm it doesn't seem to be working, maybe it was the ELF to DOL Converter.

 

[HNKii]

In my opinion, the two games that I know that requires attention are Battalion wars 2 and Excite Bike WiiWare, since their multiplayer function only works online.

 

[Wiimm]

If using our own DNS server, the traffic to mariokartwii.ms19.gs.nintendowifi.net is now also redirected. The server manage mainly the worldwide meetings. mkw-ana is now able to decode the lists with online status of players send by the server. With this new redirect I'm able to analyse this traffic for other games.

Furthermore the servers gpcm.gs.nintendowifi.net and gpsp.gs.nintendowifi.net are redirected. They manage friend lists.

 

[Nagato]

Deleted.

 

[FIX94]

I've finished work on a NoSSL patching method for Wii games. It can be found here: http://save-nintendo-wifi.com/wii-nossl.html

I do really like that idea, the only downside is the fact that there is no simple usb loader method yet so I decided to write a ocarina code which does the same as your application, it should work pretty much the same way:
http://pastie.org/private/br7rtzh28pnvpiyaqvt7a
Also, the sources if anyone is interested:
http://fix94.no-ip.org/nossl.7z

 

[leseratte]

And this cheat simply replaces https by http? This won't work, because naswii.nintendowifi.net. and mariokartwii.sake.gs.nintendowifi.net. don't listen on port 80. They only use SSL/HTTPS. The patch from Toad King also works with the sake server that has no HTTP equivalent.

 

[Toad King]

I do really like that idea, the only downside is the fact that there is no simple usb loader method yet so I decided to write a ocarina code which does the same as your application, it should work pretty much the same way:
http://pastie.org/private/br7rtzh28pnvpiyaqvt7a
Also, the sources if anyone is interested:
http://fix94.no-ip.org/nossl.7z

That's awesome! Can I put that on my site for other USB loader users?

And this cheat simply replaces https by http? This won't work, because naswii.nintendowifi.net. and mariokartwii.sake.gs.nintendowifi.net. don't listen on port 80. They only use SSL/HTTPS. The patch from Toad King also works with the sake server that has no HTTP equivalent.

I know. The page has instructions on how to use a SSL tunnel hosted by myself, so all the HTTP requests get encrypted on my server and the encrypted response is decrypted when sent back to the Wii.

 

[FIX94]

That's awesome! Can I put that on my site for other USB loader users?

Sure, just mention me and may give a link to the source

 

[AwesomeMarioFan]

Since it's relevant to the Wii as well, I'm copy/pasting the same message I just posted in the DS Wifi thread here:

I've finally uploaded the source code for what I've written so far of the server emulator. You can find it here on Github.
Be warned that this code is still very highly alpha, and probably won't work (or very well) for other people. I'm still working on it so please be patient. Right now it'll only go as far as being able to log into the server.

The main focus as of right now is the Nintendo DS but this SHOULD also work for Wii games as far as the base of the server emulation goes. Anything game-specific will need to be handled on a case-by-case basis. I have an idea of how to implement that rather nicely using individual game modules if I get to that point.

Right now I'm in the process of documenting the master server and some of the player server (gpcm.gs.nintendowifi.net). The player server is currently enough to login/logout, create/destroy sessions, get the user's profile, update the user's profile (sorta), and respond to the keep alive message.

The master server/availability server currently can only respond to the availability check that happens after getting data from NAS and before connecting to the player server.

All of my reverse engineering is done on Tetris DS so I cannot guarantee that it'll work for other games until more testing is done. My goal is to get Tetris DS at least into a basic match before the servers go down.

Awesome! Glad to see progress moving forward.

Also, if you need a host for this script/a central server for players to connect, I could host it.

 

[528491]

I'm completely noob at this, but very passionate about Wii's WiFi, supported all the possible petitions, and now once I learned that this effort doesn't require any modding of the actuall Wii console, but is done via the PC, I will surely do as much as possible to contribute, as soon as I get my PC back from repair lol

Also I see that Last Story is not on the list, I play a lot of that multiplayer, so I'll try to capture that.

Just a question to the author:
Are there any relevant differences between the stated methods of capture (Hardware Capture Guides, Emulator Capture Guides)? I mean, is there any prefered method for capturing out of all listed in the guides?

edit:
also one more question: can "WiiConnect24" be saved as well? Meaning, can this effort make Wii to Wii messaging functional again?

 

[kingofgamesgx]

glad to see something like this in the works can i request someone Get packets from the Mega Man Star Force 2 and Mega Man Star Force 3 games?


as a member of that community from back in its glory days i'd be happy for it to have a chance to live on even after nintendo kills wifi sadly as i don't have access to my DS currently i can't do it myself

 

[Videomanman87]

This is very good to see. I can't help with packet capture currently but I can help test later on. I hope that Conduit/Conduit 2 get captured as well. I see Goldeneye 700 is (very good to see, I love that game). It would also be good to see The Last Story captured as well. I doubt it will though, doesn't seem to be many people doing multiplayer, at least I have tried many times and don't seem to find anyone on. Perhaps it isn't worth it, but I haven't had a chance to actually see for myself lol.

Oh one other game: Wii Fishing Resort. While it doesn't have normal multiplayer per se , it does have ranking boards and contests which are fun.

 

[Wiimm]

DNS: Capture more data

Mario Kart Wii uses the server mariokartwii.ms19.gs.nintendowifi.net to connect to port 28910. This is a gamespy server. It is used to manage online meetings.

In general, Nintendo uses <GAME>.ms<NUMBER>.gs.nintendowifi.net for this the gamespy database queries to port 28910. <GAME> is any internal game name, ore more exact, any possible domain string (wildcard domains). <NUMBER> are numbers between 0 and 20. And all domain names are resolved to the IP4 69.10.30.247.

Since last weekend, the name server redirects mariokartwii.ms19.gs.nintendowifi.net to my server. This disadvantage of this solution is, that only MKWii traffic is redirected. But beginning with the next week, I will redirect all of the *.ms<NUMBER>.gs.nintendowifi.net domains to catch the traffic of other games. This might be dangerous, if the domains are used for other purposes.

So, if you have problems, disable the DNS server and tell me, what happened. I will post a second message when I have changed the settings.

* See also: A redirect Server

Btw:
I have now completely analysed the MKWii part of protocol of this server. Decoding is no problem, and the encoder must be tested in the next days. mkw-ana print nice statistical summaries. In the next days I will tell you more.

 

[HNKii]

DNS: Capture more data

Mario Kart Wii uses the server mariokartwii.ms19.gs.nintendowifi.net to connect to port 28910. This is a gamespy server. It is used to manage online meetings.

In general, Nintendo uses <GAME>.ms<NUMBER>.gs.nintendowifi.net for this the gamespy database queries to port 28910. <GAME> is any internal game name, ore more exact, any possible domain string (wildcard domains). <NUMBER> are numbers between 0 and 20. And all domain names are resolved to the IP4 69.10.30.247.

Since last weekend, the name server redirects mariokartwii.ms19.gs.nintendowifi.net to my server. This disadvantage of this solution is, that only MKWii traffic is redirected. But beginning with the next week, I will redirect all of the *.ms<NUMBER>.gs.nintendowifi.net domains to catch the traffic of other games. This might be dangerous, if the domains are used for other purposes.

So, if you have problems, disable the DNS server and tell me, what happened. I will post a second message when I have changed the settings.

* See also: A redirect Server

Btw:
I have now completely analysed the MKWii part of protocol of this server. Decoding is no problem, and the encoder must be tested in the next days. mkw-ana print nice statistical summaries. In the next days I will tell you more.

Great!
Since I can't capture packets(because my capture device keeps corrupting it), I guess I can finally help again!
I'll try to capture many battle packets for MKWii!

BTW, besides changing the DNS, do we have to do anything else?

EDIT:http://forum.wii-homebrew.com/wii-server/statistics.txt
There's a game ID B4T without any console/game name infomation。
I searched for the ID B4TE and found that it was tetris party on DS, and I did try online on this game, don't know why the data is missing :/
Edit: ID C34X is a Japan-only Mini 4WD game on DS.

0477-1996-7815 IMW

Can't believe this!! IMW having a Friend Code? Come on it's personal trainer:walking!!

 

[AwesomeMarioFan]

Great!
Since I can't capture packets(because my capture device keeps corrupting it), I guess I can finally help again!
I'll try to capture many battle packets for MKWii!

BTW, besides changing the DNS, do we have to do anything else?

No, the server should automatically log the data then route it to the correct location.
Essentialy, all requests for websites are being sent to that server instead of your ISP's, and the Mario Kart Wii packets are simply being logged before it is sent to the correct location.

 

[momin]

Impossible to save Monster Hunter 3, true?

I just realized this thread, a little late

 

[Wiimm]

@HNKii
Thanx for the game names, I'll add them later.