Server Functionality

Wiimm · 9. März 2014, 10:40

Here you can find a summary about the server roles: CT-Wiiki: Servers

I startet to analyse the roles of Nintendos servers. Therefore I used a series of 51 dumps. These are my main dumps for analysis and they cover all kinds of online racing activities (fc handling, battle, ww, region, and may room dumps), but not channel and ghost activities.

First I started to analyse the DNS queries to find out all relevant servers. MKWii makes this DNS queries as first steps after connected to WFC:

Quellcode

count dns name ip comment
---------------------------------------------------------------------------------
52 gamestats.gs.nintendowifi.net. 69.10.30.240 multiuse
52 gamestats2.gs.nintendowifi.net. 69.10.30.234 multiuse
52 gpcm.gs.nintendowifi.net. 69.10.30.242
52 gpsp.gs.nintendowifi.net. 69.10.30.241
52 mariokartwii.available.gs.nintendowifi.net. 69.10.30.248
52 mariokartwii.gamestats.gs.nintendowifi.net. 69.10.30.240 multiuse
52 mariokartwii.gamestats2.gs.nintendowifi.net. 69.10.30.234 multiuse
52 mariokartwii.master.gs.nintendowifi.net. 69.10.30.248
52 mariokartwii.ms19.gs.nintendowifi.net. 69.10.30.247
52 mariokartwii.natneg1.gs.nintendowifi.net. 69.10.30.254
52 mariokartwii.natneg2.gs.nintendowifi.net. 69.10.30.253
52 mariokartwii.natneg3.gs.nintendowifi.net. 69.10.30.252
36 mariokartwii.sake.gs.nintendowifi.net. 69.10.24.119
31 naswii.nintendowifi.net. 192.195.204.143 2*IP
26 naswii.nintendowifi.net. 69.25.139.143 2*IP

Alles anzeigen

Very interesting is, that naswii.nintendowifi.net has 2 IP addresses. This is a point of more investigation.

Then I analysed the traffic (new command SERVERS of mkw-ana):

Quellcode

Server 'A': mariokartwii.available.gs.nintendowifi.net. (69.10.30.248:27900)
UDP received: 14356 packets, 3074 KiB
UDP send: 1399 packets, 57 KiB
Server 'B': naswii.nintendowifi.net. (192.195.204.143:443)
TCP received: 310 packets, 61 KiB
TCP send: 217 packets, 77 KiB
Server 'C': gpcm.gs.nintendowifi.net. (69.10.30.242:29900)
TCP received: 12469 packets, 348 KiB
TCP send: 11390 packets, 891 KiB
Server 'D': gpsp.gs.nintendowifi.net. (69.10.30.241:29901)
TCP received: 313 packets, 16 KiB
TCP send: 158 packets, 40 KiB
Server 'E': mariokartwii.sake.gs.nintendowifi.net. (69.10.24.119:443)
TCP received: 783 packets, 142 KiB
TCP send: 592 packets, 260 KiB
Server 'F': mariokartwii.ms19.gs.nintendowifi.net. (69.10.30.247:28910)
TCP received: 2792 packets, 97 KiB
TCP send: 2943 packets, 63 KiB
Server 'G': mariokartwii.natneg1.gs.nintendowifi.net. (69.10.30.254:27901)
UDP received: 3026 packets, 142 KiB
UDP send: 3044 packets, 85 KiB
Server 'H': mariokartwii.natneg2.gs.nintendowifi.net. (69.10.30.253:27901)
UDP received: 767 packets, 31 KiB
UDP send: 767 packets, 22 KiB
Server 'I': mariokartwii.natneg3.gs.nintendowifi.net. (69.10.30.252:27901)
UDP received: 767 packets, 31 KiB
UDP send: 767 packets, 22 KiB

Alles anzeigen

A server is always asked at the same port. It seems, that the different ports are are assigned to functionalities.

The next step is to analyse the functionalities of each server.

Here you can find a summary about the server roles: CT-Wiiki: Servers

Wiimm · 9. März 2014, 11:28

Some statstics like above, but using all of my 243 archived dumps. This includes also some ctgpr 1.03 dumps:

Quellcode

count dns name ip
---------------------------------------------------------------------
258 gamestats.gs.nintendowifi.net. 69.10.30.240
260 gamestats2.gs.nintendowifi.net. 69.10.30.234
259 gpcm.gs.nintendowifi.net. 69.10.30.242
259 gpsp.gs.nintendowifi.net. 69.10.30.241
260 mariokartwii.available.gs.nintendowifi.net. 69.10.30.248
261 mariokartwii.gamestats.gs.nintendowifi.net. 69.10.30.240
261 mariokartwii.gamestats2.gs.nintendowifi.net. 69.10.30.234
261 mariokartwii.master.gs.nintendowifi.net. 69.10.30.248
261 mariokartwii.ms19.gs.nintendowifi.net. 69.10.30.247
259 mariokartwii.natneg1.gs.nintendowifi.net. 69.10.30.254
262 mariokartwii.natneg2.gs.nintendowifi.net. 69.10.30.253
261 mariokartwii.natneg3.gs.nintendowifi.net. 69.10.30.252
150 mariokartwii.sake.gs.nintendowifi.net. 69.10.24.119
145 naswii.nintendowifi.net. 192.195.204.143
123 naswii.nintendowifi.net. 69.25.139.143

Alles anzeigen

Quellcode

Server 'a': mariokartwii.available.gs.nintendowifi.net. (69.10.30.248:27900)
UDP received: 98506 packets, 21 MiB
UDP send: 5803 packets, 190 KiB
Server 'b': gpcm.gs.nintendowifi.net. (69.10.30.242:29900)
TCP received: 92940 packets, 2448 KiB
TCP send: 85260 packets, 6764 KiB
Server 'c': mariokartwii.ms19.gs.nintendowifi.net. (69.10.30.247:28910)
TCP received: 11198 packets, 375 KiB
TCP send: 11852 packets, 258 KiB
Server 'd': mariokartwii.natneg1.gs.nintendowifi.net. (69.10.30.254:27901)
UDP received: 17011 packets, 802 KiB
UDP send: 17023 packets, 478 KiB
Server 'e': mariokartwii.natneg2.gs.nintendowifi.net. (69.10.30.253:27901)
UDP received: 4291 packets, 176 KiB
UDP send: 4287 packets, 121 KiB
Server 'f': mariokartwii.natneg3.gs.nintendowifi.net. (69.10.30.252:27901)
UDP received: 4291 packets, 176 KiB
UDP send: 4286 packets, 121 KiB
Server 'A': naswii.nintendowifi.net. (192.195.204.143:443)
TCP received: 1442 packets, 285 KiB
TCP send: 1005 packets, 357 KiB
Server 'B': gpsp.gs.nintendowifi.net. (69.10.30.241:29901)
TCP received: 1572 packets, 98 KiB
TCP send: 794 packets, 279 KiB
Server 'C': mariokartwii.sake.gs.nintendowifi.net. (69.10.24.119:443)
TCP received: 8738 packets, 1554 KiB
TCP send: 6946 packets, 2746 KiB

Alles anzeigen

Wiimm · 9. März 2014, 11:38

About 2 IPs for naswii.nintendowifi.net.
The name server delivers both IPs randomly.
I made 30 queries to the AUTHORITY name server in a few seconds and get 16* 192.195.204.143 and 14* 69.25.139.143 with ttl value 30 (time-to-live in seconds for a dns cache). This is a normal usage for load balancing.

Wiimm · 9. März 2014, 13:08

Forth post in row

I have setup a wiki summary page about the servers:
* wiki.tockdom.com/wiki/MKWii_Network_Protocol/Servers

I have also updated mkw-ana. The new version supports the new kind of server statistics (see above).
* download.wiimm.de/mkw-ana/bin/

Wiimm · 9. März 2014, 19:15

For documentation and reference I'm searching a good name for the protocol that sends data as a string in the format:

Quellcode

\name1\value1\name2\value2\....\final\

Examples:
* backslash protocol
* backslash-list protocol
* backslash-param protocol
* text-param protocol
* ....

Leseratte · 9. März 2014, 19:18

When downloading the leaderboards, MKWii also connects to mariokartwii.race.gs.nintendowifi.net.

Wiimm · 9. März 2014, 19:44

I have updated mkw-ana again and also uploaded dump collections filtered by the the nintendo servers:
* download.wiimm.de/mkw-ana/bin/
* download.wiimm.de/mkw-ana/dumps/filtered-by-server/

And now I'm entering region 123

Wiimm · 16. März 2014, 01:45

Because it's so quiet here ...

Today (Saturday) I analysed the server communication based on "\name\value" strings.
Results:
* wiki.tockdom.com/wiki/MKWii_Ne…ntendowifi.net#Parameters
* wiki.tockdom.com/wiki/MKWii_Ne…ntendowifi.net#Parameters

At the moment I run a script, that analyses the parameter combinations used by the servers.

Wiimm · 17. März 2014, 16:34

About "uniquenick"

Quellcode

-------------------------------------------------------------
player id _friend code__ ______uniquenick______ Wii
-------------------------------------------------------------
302594991 0432-5226-7951 7dkjp51v5 RMCJ 2nr3vs9 Wiimm
475086007 4299-7181-5607 7dkjp51v5 RMCJ 1hqi73g Wiimm
475087203 0305-3985-8275 7dkjp51v5 RMCJ 2e48m6u Wiimm
-------------------------------------------------------------
475087193 4729-2148-9753 5dhngv1kg RMCJ 1a4ppqv Leseratte
474799787 2452-8793-5659 5dhngv1kg RMCJ 3tp0u3u Leseratte
------------------------------------------------------------
475087286 3011-2279-8006 1unitvi86 RMCJ 2eofm6a Chris
-------------------------------------------------------------

Alles anzeigen

The first 9 bytes are the Wii identification, followed by the game id, followed by a player identification with 7 bytes.

Both identifications use 0-9 and a-v as alphabet, 32 different characters.

For the Player-ID we have 7*5=35 bits. I have found values between "00ho3v1" and "3us4s8p". This could mean that 32 bits are used, like expected. The coding itself is not clear yet (BASE32 use the same alphabet with upper case letters).

For the Wii-ID we have 9*5=45 bits. I have found values between "06akfoutt" and "7v1nenejb". This could mean that 43 bits are used.

Leseratte · 17. März 2014, 16:58

Have you already set up a proxy server for the https thing?

If yes, we might also return two different IPs (both of a proxy) for mariokartwii.available.gs.nintendowifi.net. and mariokartwii.master.gs.nintendowifi.net. to find out when the Wii uses the first server and when the second.

EDIT:

32 characters? If I count all letters from a to v and all numbers from 0 to 7, I'll get 30 different characters.

abcdefghijklmnopqrstuv01234567

gskw · 17. März 2014, 17:06

Wiimm schrieb:

1unitvi86

That's 0-8 or 0-9. Or is it just a typo?

Wiimm · 17. März 2014, 17:22

1.) No, I haven't setup the proxy.
2.) alphabet is 0-9 a-v

EDIT:
Here is a list of codes and related player ids. Perhaps you find out the coding:

Spoiler anzeigen

Quellcode

-------------------------------
pid/dec pid/hex code
-------------------------------
134502151 0x08045707 2360bl1
134533359 0x0804d0ef 2sdn4or
134660282 0x0806c0ba 0qrdodg
134670440 0x0806e868 1b5kebi
134813116 0x080915bc 2rp3ic6
134877636 0x080a11c4 1spcl3v
135308298 0x0810a40a 1eaieqa
135518570 0x0813d96a 16125gn
135591625 0x0814f6c9 0npiqi6
135886901 0x08197835 20gnsk9
136480272 0x08228610 2dfj98l
136910083 0x08291503 38sfjdb
137022435 0x082acbe3 1n7l3p3
138125109 0x083b9f35 3dcf70n
138496777 0x08414b09 0f9bnq2
138725088 0x0844c6e0 3o48cj8
138977664 0x0848a180 0gjh5pt
141529431 0x086f9157 2rruut5
142260308 0x087ab854 1u36blr
145181960 0x08a74d08 0kqs91v
145986643 0x08b39453 0nrj64n
146376154 0x08b985da 2i5321j
150826460 0x08fd6ddc 0gqmf98
152098644 0x0910d754 3vrloho
158191804 0x096dd0bc 2dvci71
166227327 0x09e86d7f 13d1f35
169523373 0x0a1ab8ad 0a9cq6o
175258133 0x0a723a15 3m59lrq
179717370 0x0ab644fa 39tvpof
187210028 0x0b28992c 2ar247h
187998795 0x0b34a24b 274d6qe
190729816 0x0b5e4e58 18maf8g
192817284 0x0b7e2884 2jrsh23
193178453 0x0b83ab55 3nhu50f
195476978 0x0ba6bdf2 2pqho55
195512220 0x0ba7479c 38nir85
195562777 0x0ba80d19 09vv8br
196305870 0x0bb363ce 20fsrso
196618040 0x0bb82738 21lkiea
201304016 0x0bffa7d0 1cr9vh8
207392769 0x0c5c9001 3uk8k7r
208593511 0x0c6ee267 1q3o719
217817144 0x0cfba038 3jvovm0
233295028 0x0de7ccb4 3ni51hv
235254043 0x0e05b11b 1ptiv7l
237263764 0x0e245b94 065d1ul
241215375 0x0e60a78f 2nsq596
244044621 0x0e8bd34d 2ovv8sh
248736965 0x0ed36cc5 3qdsdi9
270390535 0x101dd507 23tvr59
282448943 0x10d5d42f 2879f5l
294909767 0x1193f747 3t7kdis
295941470 0x11a3b55e 1gr4boa
298724824 0x11ce2dd8 3rkgu4q
301273266 0x11f510b2 2da6f9h
303620827 0x1218e2db 3fekl43
304111337 0x12205ee9 1gjre51
305733004 0x12391d8c 0e37676
324078642 0x13510c32 0v0uhc9
335872113 0x14050071 3u8qmar
343917081 0x147fc219 3lg5lsj
350951571 0x14eb1893 3li4ls2
354860031 0x1526bbff 23ioucc
357676601 0x1551b639 34ou2ri
358966247 0x156563e7 3mpqqg2
362755626 0x159f362a 0cscgtg
368031897 0x15efb899 1o8f56p
369085739 0x15ffcd2b 2kii4s6
369478991 0x1605cd4f 0re0fii
370986222 0x161cccee 1rlucke
372265969 0x163053f1 20537ls
386207532 0x17050f2c 1vrbr8p
392267465 0x176186c9 14u6fsd
394609454 0x1785432e 30uv7r7
398376029 0x17bebc5d 37fkagb
407638173 0x184c109d 3pk0ro6
411747222 0x188ac396 2vuk76k
412464514 0x1895b582 1fpun9m
413200681 0x18a0f129 2e3lntu
416055662 0x18cc816e 3lq4bg3
418960355 0x18f8d3e3 09ccaaj
419392779 0x18ff6d0b 310p698
420030955 0x190929eb 322bbd6
423340725 0x193baab5 0msg822
436638623 0x1a06939f 1tur37j
438343606 0x1a2097b6 25urqqn
440907198 0x1a47b5be 36o0cfg
441687088 0x1a539c30 17o675t
442045117 0x1a5912bd 17tflml
444241868 0x1a7a97cc 1abs7ej
446006506 0x1a9584ea 2dok78h
447214276 0x1aa7f2c4 2ljh72h
448342494 0x1ab929de 2luv7b7
448618407 0x1abd5fa7 0bgms02
449615791 0x1acc97af 00ho3v1
450197498 0x1ad577fa 38gem1n
450341135 0x1ad7a90f 1gdc1mr
456284963 0x1b325b23 1b10u02
456609461 0x1b374eb5 1pe35u8
468445343 0x1bebe89f 2nohk8t
469604577 0x1bfd98e1 142q65e
473134737 0x1c337691 1mgt2ta
474799787 0x1c4cdeab 3tp0u3u
475086133 0x1c513d35 1ao9emb
475087193 0x1c514159 1a4ppqv
475087203 0x1c514163 2e48m6u
475087286 0x1c5141b6 2eofm6a
475511021 0x1c57b8ed 2vh1pe3
475512163 0x1c57bd63 0phke2e

Alles anzeigen

Chadderz · 17. März 2014, 18:01

I've found the encode (800eba5c PAL) and decode (800ec844 PAL) methods for this particular base 32 variant, I'll let you know when I've figured them out.

EDIT:
I was wrong, it's not an encode/decode pair as I'd assumed, the game doesn't seem to have a way to decode these strings, it just compares them. The alphabet is just 0-9a-v in that order, encoding groups of 5 bits as you'd expect, so the real question is where the value comes from, which may take me a little bit longer to find.

EDIT2:
I'm now reasonably certain that value is a random number.

Wiimm · 17. März 2014, 23:21

Chadderz schrieb:

EDIT2:
I'm now reasonably certain that value is a random number.

The uniquenick is provided by the server. But I don't believe a random number, because the server must known, which nicks were already provided.

However, if the Wii simply store and compare it, our own server can create the nicks by own rules.

Chadderz · 17. März 2014, 23:29

Wiimm schrieb:

The uniquenick is provided by the server. But I don't believe a random number, because the server must known, which nicks were already provided.

However, if the Wii simply store and compare it, our own server can create the nicks by own rules.

Well, I may be wrong, reading machine code isn't easy, but as far as I can tell, the last part of the unique nick is a random number generated on the Wii.

Wiimm · 17. März 2014, 23:40

Chadderz schrieb:

Well, I may be wrong, reading machine code isn't easy, but as far as I can tell, the last part of the unique nick is a random number generated on the Wii.

Analysing the the network traffic for a new virgin MKWii with blank profiles, I see the nick first time in the packet, where the server provides the new player id:

Quellcode

18:26:32.709 C<2 69.10.30.242:29900 -> 192.168.178.51:61170, client -1
171 (0xab) data bytes in 1 record [TCP=ACK,PSH]
-1.----.TPAR, ab (171/dec) bytes, offset 0x00
lc = 2
sesskey = 203638480
proof = 513c6d8f79a40d370ee45e51acea404c
userid = 442973221
profileid = 475086007 [4299-7181-5607]
uniquenick = 7dkjp51v5RMCJ1hqi73g
lt = U[FFmnurtt8lQXg81TKNeh__
id = 1
final /

Alles anzeigen

But this does not exclude, that the Wii create the nick and send it to the server e.g. on a SSL way.

Chadderz · 18. März 2014, 00:32

Wiimm schrieb:

Analysing the the network traffic for a new virgin MKWii with blank profiles, I see the nick first time in the packet, where the server provides the new player id:

Quellcode

18:26:32.709 C<2 69.10.30.242:29900 -> 192.168.178.51:61170, client -1

171 (0xab) data bytes in 1 record [TCP=ACK,PSH]

-1.----.TPAR, ab (171/dec) bytes, offset 0x00

lc = 2

sesskey = 203638480

proof = 513c6d8f79a40d370ee45e51acea404c

userid = 442973221

profileid = 475086007 [4299-7181-5607]

uniquenick = 7dkjp51v5RMCJ1hqi73g

lt = U[FFmnurtt8lQXg81TKNeh__

id = 1

final /

Alles anzeigen
But this does not exclude, that the Wii create the nick and send it to the server e.g. on a SSL way.

The method I metioned earlier makes a call out to snprintf with the format string "%s%c%c%c%c%s" and is used as the uniquenick. From what I can tell (without running the game) that last %s comes from a base32 conversion on a number that is generated near to a log message "Hmm.. you need to create authentic login id.\n".

Wiimm · 20. März 2014, 00:30

Strings of main.dol/PAL containing the word "nintendowifi"

Quellcode

%s.available.gs.nintendowifi.net
%s.gamestats.gs.nintendowifi.net
%s.gamestats2.gs.nintendowifi.net
%s.master.gs.nintendowifi.net
%s.ms%d.gs.nintendowifi.net
%s.natneg1.gs.nintendowifi.net
%s.natneg2.gs.nintendowifi.net
%s.natneg3.gs.nintendowifi.net
gamestats.gs.nintendowifi.net
gamestats2.gs.nintendowifi.net
gpcm.gs.nintendowifi.net
gpsp.gs.nintendowifi.net
gs.nintendowifi.net
http://%s.sake.gs.nintendowifi.net/SakeStorageServer/StorageServer.asmx
https://%s.sake.gs.nintendowifi.net/SakeFileServer/download.aspx
https://%s.sake.gs.nintendowifi.net/SakeFileServer/upload.aspx
https://%s.sake.gs.nintendowifi.net/SakeStorageServer/StorageServer.asmx
https://naswii.dev.nintendowifi.net/ac
https://naswii.dev.nintendowifi.net/pr
https://naswii.nintendowifi.net/ac
https://naswii.nintendowifi.net/pr
https://naswii.test.nintendowifi.net/ac
https://naswii.test.nintendowifi.net/pr
natneg1.gs.nintendowifi.net
natneg2.gs.nintendowifi.net
natneg3.gs.nintendowifi.net

Alles anzeigen

The "%s" is usually replaced by "mariokartwii" and "%d" by numbers 1–

Same for StatcR.rel

Quellcode

%s://mariokartwii.sake.gs.nintendowifi.net/SakeFileServer/ghostdownload.aspx?gameid=1687&region=0&p0=%d&c0=%d&t0=%d
%s://mariokartwii.sake.gs.nintendowifi.net/SakeFileServer/ghostupload.aspx?gameid=%d&regionid=%d&courseid=%d&score=%d&pid=%d&playerinfo=%s%s
http://%s.race.pubsvs.gs.nintendowifi.net/RaceService/NintendoRacingService.asmx
http://mariokartwii.race.gs.nintendowifi.net/RaceService/NintendoRacingService.asmx
https://mariokartwii.race.gs.nintendowifi.net/RaceService/NintendoRacingService.asmx
https://mariokartwii.race.gs.nintendowifi.net/raceservice/maindl_%s_%s.ashx
https://mariokartwii.race.gs.nintendowifi.net/raceservice/messagedl_%s_%s.ashx
https://mariokartwii.sake.gs.nintendowifi.net/SakeFileServer/ghostdownload.aspx?gameid=1687&region=0

Wiimm · 30. März 2014, 00:34

A progress message:
mkw-ana is now able to decode the responses of server 'ms19', if the request was made by a known user (not only "mariokartwii"). I have found a list with 3054 user and keyword combinations.

The next problem is the server side encoding.

fugur · 9. Mai 2014, 11:33

sorry, I didn't get it:
is userid a value derived from any parameter sent during connection to naswii-server or is it just something, the backend knows (like the profileid)?

Wiimm schrieb:

18:26:32.709 C<2 69.10.30.242:29900 -> 192.168.178.51:61170, client -1
171 (0xab) data bytes in 1 record [TCP=ACK,PSH]
-1.----.TPAR, ab (171/dec) bytes, offset 0x00
lc = 2
sesskey = 203638480
proof = 513c6d8f79a40d370ee45e51acea404c
userid = 442973221
profileid = 475086007 [4299-7181-5607]
uniquenick = 7dkjp51v5RMCJ1hqi73g
lt = U[FFmnurtt8lQXg81TKNeh__
id = 1
final /

Wiimm · 9. Mai 2014, 11:47

It seems, that the user_id is a value known by the server (internal ID). And for MKWii is seems to be irrelevant, because my server always replies the profile_id as user_id.

Server Functionality

Server Functionality

Quellcode

Quellcode

Quellcode

Quellcode

Quellcode

Quellcode

Wiimm schrieb:

Quellcode

Chadderz schrieb:

Wiimm schrieb:

Chadderz schrieb:

Quellcode

Wiimm schrieb:

Quellcode

Quellcode

Quellcode

Wiimm schrieb:

Teilen

Benutzer online 1