Network Summary

Wiimm · 3. März 2014, 16:57

Network Overview

If entering the WFC, the Wii starts up with DNS resolution to find about 12 Servers. The servers play different roles and all have backup servers. The connections between Wii and servers is done by using the TCP protocol and rarely the UDP protocol. The servers manage mainly the friend codes and the distribution of players to rooms and races. Here, Leseratte is the man with the most knowledge.

One of the servers seems to be a database server. If a player enters or leaves WFC or a room, It sends SQL related messages as notifier. If searching for players, it send queries with database and table names, a SQL-SELECT list and a SQL-WHERE clause. It is also possible to ask the servers for statistical data. See this database server as a central dispatcher!

While racing, the the players exchange data peer to peer using UDP. Each Wii send all 1/30s exact one packet (about 200-300 bytes) to exact one other Wii. The servers will communicate with each Wii only every seconds (ALIVE signal). I spent most of my analysing in this peer to peer packets, but they don't help us to understand the server protocols.

I started end 2012 with the analysis. So have have many dumps, most of them are room events.

Chadderz · 3. März 2014, 17:01

How essential are all these servers? Obviously we'd like to support friend codes eventually, but just for allowing WFC search, which should be our top priority, is it sufficient just to impersonate the 'SQL database' server?

Leseratte · 3. März 2014, 17:08

Every server is important. If the Wii can't find / connect to one server, it won't connect.

Wiimm · 3. März 2014, 17:20

Most (all?) servers are managed by ign.com and it seems, that the are a central point of online management. If we are able to create a sql clone, it will help all other games, because (I think so) they use the same protocol. I think, the implementation don't take so much efforts. The security including FC white and black lists (trolling the sql server will be very bad) is more complex.

Back to your question: I think, the SQL server is essential.

Chadderz · 3. März 2014, 19:20

I think we should work in phases; get each server replaced one by one. I think this SQL server is the most important from the sounds of it, so we should work on that first. I think the coding work should be done in C, since I know Bean, Wiimm and I can both do it. Do you want to host the project Wiimm? Or we could use github, google code, or something similar?

Leseratte · 3. März 2014, 19:22

I would say the login server / process is more important - if you can't get SQL to work, it should be still possible to play in friend rooms. But if we can't get the login to work - well, then nothing will work.

Chadderz · 3. März 2014, 19:25

So you're saying it logs into one server, then searches for matches on another? If so, I'm pretty sure if worst came to worst the game could be rewritten to avoid login at all, and just do anonymous room searching. I think we should focus on the bit that is ESSENTIAL for online play.

soneek · 3. März 2014, 19:32

I've been testing out an emulator for the gamespy login servers for Brawl support, and I'm making progress little by little. Someone had done research on the authentication a while ago, and it''s all documented.

GS Protocol documentation and tools

There is a WIP modification of the emulator to use SQL , but it needs to be modified to work on Linux, so that's it's easier to host through a web server. More updates need to be made in order to match the Wii protocol, but it's similar enough to other games that use gamespy. One difficult part would be emulating the "master" server, but we should be able to make a lot of progress with the authentication given that we have code to work with.

Wiimm · 3. März 2014, 23:13

Chadderz schrieb:

I think the coding work should be done in C, since I know Bean, Wiimm and I can both do it.

C or C++ or other languages are good. We should first write down the functional specification and decide afterward about the programming language.

Chadderz schrieb:

Do you want to host the project Wiimm? Or we could use github, google code, or something similar?

I think, a global hoster is the best. GIT and SVN are ok for me.

Wiimm · 4. April 2014, 21:47

Server Knowledge Status

Here is a status of my knowledge.

gpcm.gs.nintendowifi.net
* This connection is used to manage friends and to inform about the online status.
STATUS: Protocol known, but not the influence of all parameters.

gpsp.gs.nintendowifi.net
* The server translates player ids into user nicks (friend list related).
STATUS: 100%

mariokartwii.master.gs.nintendowifi.net
Leseratte knows more...

mariokartwii.ms19.gs.nintendowifi.net
* This server handles database requests to manage online matchmaking.
STATUS: 100%

mariokartwii.natneg*.gs.nintendowifi.net
* Those three servers do NAT negotiation to bypass NAT and firewalls.
Leseratte knows (almost) all.

mariokartwii.sake.gs.nintendowifi.net
* Handles ghosts
Can be deactivated.

naswii.nintendowifi.net
* Login Server.
Can be switched to use HTTP instead of HTTPS. Easy protocol, almost clear.

mariokartwii.race.gs.nintendowifi.net
* This server is used for time race / global leader boards.
Can be switched to use HTTP instead of HTTPS. Must be analysed in more detail.

Tock · 4. April 2014, 21:53

Wiimm schrieb:

mariokartwii.sake.gs.nintendowifi.net
* Handles ghosts
Can be deactivated.

Sad Tock is going to be sad.

Leseratte · 4. April 2014, 21:55

Well, we don't even have a way dumping the sake data w/o SSL. So I don't think we can make ghosts work on our server.

@Chadderz: How far is your SSL dumping app?

Tock · 4. April 2014, 21:56

Well Maschell knows how to dump ghosts from the Server to a PC^^.

Leseratte · 4. April 2014, 21:59

We don't just need the ghost data - I can already download them, I think. We'll need the protocol the Wii uses for up- and downloading of the ghost data. And this only works if we'd be able to dump the sake data without encryption.

Tock · 4. April 2014, 22:00

Shouldnt that work with the Dolphin build?

Wiimm · 4. April 2014, 22:04

Sorry to say that:
Ghost servers are irrelevant for me until all others servers will be run productive. So deactivating SAKE is a 100% good solution for me and for the moment.

Tock · 4. April 2014, 22:05

As long as its not completly gone from the to do list (last thing?) im fine :x

Wiimm · 4. April 2014, 22:11

Feel free to collect as many decrypted dumps as possible for later analysis.

Leseratte · 4. April 2014, 22:59

@Wiimm: Sometimes the wii tries to connect to the following servers when performing a connection test. If you have a UDP logging server ready, you should also redirect those domains:

Quellcode

wiinat.available.gs.nintendowifi.net.
wiinat.natneg1.gs.nintendowifi.net.
wiinat.natneg2.gs.nintendowifi.net.
wiinat.natneg3.gs.nintendowifi.net.

Toad King · 5. April 2014, 02:24

Leseratte schrieb:

Well, we don't even have a way dumping the sake data w/o SSL. So I don't think we can make ghosts work on our server.

@Chadderz: How far is your SSL dumping app?

I've been able to get sake server dumps from the console by forcing HTTP and using a HTTP->HTTPS proxy. The communication seems to be using SOAP as the payload.

Wiimm · 5. April 2014, 09:42

Toad King schrieb:

I've been able to get sake server dumps from the console by forcing HTTP and using a HTTP->HTTPS proxy.

What is your recommendation for such proxy?
Or can we use your proxy?

Toad King · 5. April 2014, 15:44

Wiimm schrieb:

Toad King schrieb:

I've been able to get sake server dumps from the console by forcing HTTP and using a HTTP->HTTPS proxy.

What is your recommendation for such proxy?
Or can we use your proxy?

I use NGINX + MITMproxy with a script designed to convert incoming HTTP requests to certain Nintendo domains to HTTPS requests. You can use my proxy yourself: save-nintendo-wifi.com/wii-nossl.html (note that the proxy doesn't log anything, just does conversions.)

If you want to try to set it up yourself this is the script I use:

Quellcode

def request(ctx, flow):
#ctx.log("host: " + flow.request.headers["Host"][0])
flow.request.host = flow.request.headers["Host"][0]
if ".nintendowifi.net" in flow.request.headers["Host"][0]:
flow.request.scheme = "https"
flow.request.port = 443
else:
flow.request.port = 80

You also need to use client-side certs for each domain (at least for the sake ones. dls1.nintendowifi.net is used on DS games so it doesn't use client-side certs). These can be made from the client certs you get from Dolphin's Wii network guide: dolphin-emu.org/docs/guides/wii-network-guide/

Note that this setup requires MITMproxy to be in transparent proxy mode, so you need the latest version from source/pip. The latest version in at least Debian repos don't have it yet.

Leseratte · 6. April 2014, 08:45

A user at gbatemp.net (Nagato) is able to play Tetris DS on his own servers (friend rooms only). His code may be helpful.

Code
gbatemp

Wiimm · 6. April 2014, 11:06

I have already archived and made quick review. It may be give us some hints.

Network Summary

Network Summary

Chadderz schrieb:

Chadderz schrieb:

Wiimm schrieb:

Quellcode

Leseratte schrieb:

Toad King schrieb:

Wiimm schrieb:

Toad King schrieb:

Quellcode

Teilen

Benutzer online 1