/dev/net/ssl

gskw · 16. März 2014, 12:09

I found an interesting article on WiiBrew.
I also found some C code linked on the page.
That might help us understanding how the SSL communication works.

Chadderz · 16. März 2014, 14:29

I'm already very familiar with all the IOS networking code, I've found all the relevant symbols in Mario Kart already. Thanks for sharing what you find though.

For a progress report, I'm back home from University now, so I'm more free to help. I've sarted the Wii based network/SSL dumper, not sure how long it will take at this point. I'm writing this a generic loader which takes in an unlinked object file and links it into the game's DOL at launch time. This will give us an excellent base for further experimentation. It'll enable you to write something like

Quellcode

REPLACE_METHOD(SSL_Read, my_SSL_Read);
int my_SSL_Read(int socket, void *data, size_t length) {
int ret = SSL_Read(socket, data, length);
fprintf(log, "SSL_Read(%d, %p, 0x%x) = %d\n", socket, data, length, ret);
return ret;
}

In this example, I've told the loader to replace the game's SSL_Read method with my custom one. I'm then able to call the original method and do something like log the message for example. This approach should be totally general, allowing us to replace methods in any game with ease.

gskw · 16. März 2014, 17:54

That is great! Please make the app open source, that's exactly what I need for mine.

Leseratte · 23. März 2014, 20:17

@Chadderz:Have you found out something yet? How long will your SSL-dumper need to get finished?

Chadderz · 24. März 2014, 19:30

It is going well, hopefully I'll have it released by the end of the week.

Leseratte · 24. März 2014, 20:56

@Chadderz:
@Wiimm:
I got it!

I can see unencrypted SSL data in Wireshark.
(That was much easier than I thought)

Exact Tutorial on how to patch the game to do this will follow until tomorrow.

Toad King · 24. März 2014, 21:16

Leseratte schrieb:

@Chadderz:
@Wiimm:
I got it!

I can see unencrypted SSL data in Wireshark.
(That was much easier than I thought)

Exact Tutorial on how to patch the game to do this will follow until tomorrow.

Nice, you got this without any MITM proxies? Also, does your patch potentially work on other games or just MKWii?

Leseratte · 24. März 2014, 21:17

W/o any proxy. Simply modification of game that probably works for all other Wii games, too.
All the data that is normally crypted (from and to naswii.nintendowifi.net. ~~- the other server race.gs.nintendowifi.net won't work with this patch~~ and from and to race.gs.nintendowifi.net.) shows up (cleartext) in a simple tcpdump (as you see in the picture above).

christian8246q · 24. März 2014, 21:23

Is that a patched file in Mario Kart, or something other?
If what you say is true, I'll take probably tomorrow with a small dump for you.

Toad King · 24. März 2014, 21:27

Leseratte schrieb:

W/o any proxy. Simply modification of game that probably works for all other Wii games, too.
All the data that is normally crypted (from and to naswii.nintendowifi.net. - the other server race.gs.nintendowifi.net won't work with this patch) shows up (cleartext) in a simple tcpdump (as you see in the picture above).

Just a guess at what you did: are you using the DS nas server (nas.nintendowifi.net) instead?

Leseratte · 25. März 2014, 06:57

Toad King schrieb:

Just a guess at what you did: are you using the DS nas server (nas.nintendowifi.net) instead?

Thats it (and a little bit more). The DS-Server returns the same answer then the Wii one, but it answers on HTTP questions.

In the Attachment of this post there are the two patch files (for PAL).

Simply extract an MKWii PAL image (patches for other regions will follow soon), and run the following commands (Linux)

Quellcode

bspatch main.dol main_new.dol main_dol_patch_PAL.bin

bspatch StaticR.rel StaticR_new.rel StaticR_rel_patch_PAL.bin

(you need bspatch for this)

Then delete main.dol and StaticR.rel, rename the two new files to main.dol and StaticR.rel and pack the file system back to an image.

When using this image, the SSL-Communication to race.gs.nintendowifi.net. and nas(wii).nintendowifi.net. runs over simple HTTP.
I don't know if this patch also works with Wiimms MKW Fun (maybe the file offsets are different). I'll try this afternoon.

I was only able to test the PAL-Patch because I only have a PAL image.

EDIT: The new Patches remove SSL while logging in and at the race-Server, but not at the sake-Server.

EDIT: Please use Wiimms "wstrt" for patching now. It works much better.

christian8246q · 25. März 2014, 07:05

Is there a Windows alternative? I have on my PC a Ubuntu VM and come with it really well, but I think some people do not want to download for Linux for this patch.

Leseratte · 25. März 2014, 07:10

Here is a Windows port, but I haven't tested it yet: sites.inka.de/tesla/others.html#bsdiff

christian8246q · 25. März 2014, 07:23

I'll test it when I get home from school. At 13:15 I would be home. I will probably also create a dump, then I upload it to the wfc-share server.

Wiimm · 25. März 2014, 11:28

That are are the changes in main.dol (PAL):

Quellcode

-https://naswii.test.nintendowifi.net/ac
-https://naswii.nintendowifi.net/ac
-https://naswii.dev.nintendowifi.net/ac
-https://naswii.test.nintendowifi.net/pr
-https://naswii.nintendowifi.net/pr
-https://naswii.dev.nintendowifi.net/pr
+http://nas.test.nintendowifi.net/ac
+http://nas.nintendowifi.net/ac
+http://nas.dev.nintendowifi.net/ac
+http://wii.test.nintendowifi.net/pr <<<< IS THIS CORRECT?
+http://nas.nintendowifi.net/pr
+http://nas.dev.nintendowifi.net/pr

Alles anzeigen

That are are the changes in staticr.rel (PAL):

Quellcode

-https://mariokartwii.race.gs.nintendowifi.net/raceservice/maindl_%s_%s.ashx
-https://mariokartwii.race.gs.nintendowifi.net/raceservice/messagedl_%s_%s.ashx
+http://mariokartwii.race.gs.nintendowifi.net/raceservice/maindl_%s_%s.ashx
+http://mariokartwii.race.gs.nintendowifi.net/raceservice/messagedl_%s_%s.ashx

I think, a simple 'sed' command can do it for all 4 regions.

EDIT;
The sed command for main.dol:
sed -r 's+https://naswii([!-z]*)+http://nas\1\x00\x00\x00\x00+g' main.dol >patched.dol

christian8246q · 25. März 2014, 13:30

I have tried to determine the local ip of my Wii. Apparently it is 192.168.137.201. I'll try to make tcpdump run with this IP as a filter, let's see if I mkw-ana then outputs a result. If so, then I'll do a dump with exactly this filter. That would be convenient, then no foreign traffic would at least be there.

Edit: Yessssss it works....

Leseratte · 25. März 2014, 13:44

Wiimm schrieb:

+wii.test.nintendowifi.net/pr <<<< IS THIS CORRECT?

No, i've made a mistake while Hex-editing. it should be "http://nas.test.nintendowifi.net/pr".

christian8246q · 25. März 2014, 14:30

Wait - Leseratte you said that you had made a mistake, does that mean that your zip with the patch is invalid?

Leseratte · 25. März 2014, 14:35

It should work anyway - I never saw a Wii connecting to one of the test / dev servers.

But I've sent a corrected Version to Wiimm, maybe he can create an easier patch system for this.

Leseratte · 25. März 2014, 16:10

I've uploaded a corrected Patch for all regions.

Wiimm · 25. März 2014, 18:40

Here is a "sed" solution, but it works only under Linux, Mac and other Unixoids.
I planned also Windows support. But Cygwin fails, because it translates CR+LF into LF and the the provided option --binary doesn't help.

* Download: http://download.wiimm.de/wii-server/dol+rel.zip

Later, if we know, that it works, I'll implement this kind of patch into my wstrt tool.

Leseratte · 25. März 2014, 21:34

Wiimm and I were able to redirect the (now) HTTP data through his server (we added Ports to the domain name in the main.dol) and he could read the data which is normally transmitted over SSL in clear text.
Tomorrow we'll try the same with mariokartwii.race.gs.nintendowifi.net.

Wiimm · 25. März 2014, 21:48

What we did:

We replaced "https://naswii.nintendowifi.net/" by "http://name.mydomain.de:81/"
Started an redirector, that listens at port 81 and redirects all traffic to naswii.nintendowifi.net port 80.
WFC entered and 2 races played in the room.

Leseratte · 26. März 2014, 15:53

Wiimm schrieb:

We replaced "https://naswii.nintendowifi.net/" by "https://name.mydomain.de:81/"

We replaced it by "http". Not "https". Then all the traffic was unencrypted.
And we didn't redirect to naswii.nintendowifi.net but to nas.nintendowifi.net

m4xiking · 26. März 2014, 17:12

Can't the patch just be applied with WIT? It are files of the game, but modified, right? So it's possible to extract the image, replace the files and put it together again?

Quellcode

Quellcode

Quellcode

Quellcode

Teilen