Hacking Save Nintendo WiFi - A project to save online servers for Wii (and DS) games

[AzerothArg]

For Endless ocean 2 Online is a like Animal Crossing.
Tell me your if you want to play EO2 with me

Never played that either, but got it figured out. not sure if we can, as my savegame is just passing one of the first missions, where you rescue Oceana whom went to recover her mother's pendant.

I can only upload captures people send me. Games like the CoD games use different servers so those will take a whole lot more work to reverser engineer.

Agree, also, I've found that CoD MW3 won't load multiplayer on dolphin, only on real wii, and there (AFAIK) we can't get any ssl encrypted data... Still, I'll try to capture whatever I can. Quick question: would a linux box running wireshark (with proper filtering) be able to capture those packets coming from and to the wii orI need to capture them from within the router itself?

EDIT: Now that I remember, CoD seems to use external servers for matchmakig only, since once the game is about to start it picks a host between the users in the lobby, and also noticed a few times that the game suddenly ends with the message "host ended the game"

 

[Lakster]

Quick question: would a linux box running wireshark (with proper filtering) be able to capture those packets coming from and to the wii orI need to capture them from within the router itself?

If you have a DD-WRT flashed router or similar you can use commands to forward all packets to any IP on the subnet, which is how I plan on doing it. (Guide on Toad King's site). Also, I've had some success using a Linux with a wireless usb acting as a Soft AP (mostly because my college internet doesn't play well with Wii/DS) so that the linux machine acts as a router itself which you might try.

 

[Toad King]

Quick question: would a linux box running wireshark (with proper filtering) be able to capture those packets coming from and to the wii orI need to capture them from within the router itself?

Basically any sufficient device you get get between the DS/Wii and the Internet can be used for port mirroring/recording. I've used a Raspberry Pi acting as an AP and recorded that way.

 

[Thassalar]

Besides Goldeneye I also had a quick peek at other Games I know use non-Nintendo servers to see what servers they look up:

Goldeneye

stun.us.demonware.net                               209.170.124.117
stun.eu.demonware.net                               209.170.72.124
stun.jp.demonware.net (CNAME stun.us.demonware.net) 209.170.124.117
stun.au.demonware.net (CNAME stun.eu.demonware.net) 209.170.72.124
jb2010-wii-live.auth.mmp3.demonware.net             209.170.72.28
jb2010-wii-live.lsg.mmp3.demonware.net              209.170.72.27
naswii.nintendowifi.net                             69.25.139.143  [SSL]

Call of Duty: Black Ops

cod7-wii-auth-dw.prod.demonware.net  209.170.72.26
cod7-wii-lobby-dw.prod.demonware.net 209.170.72.13
naswii.nintendowifi.net              69.25.139.143  [SSL]
stun.us.demonware.net                209.170.124.117
stun.eu.demonware.net                209.170.72.124

Call of Duty: Modern Warfare 3

mw3-wii-auth.prod.demonware.net                         209.170.124.209
mw3-wii-lsg.prod.demonware.net                          209.170.124.211
naswii.nintendowifi.net                                 69.25.139.143  [SSL]
mw3-stun.us.demonware.net (CNAME stun.us.demonware.net) 209.170.124.117
mw3-stun.eu.demonware.net (CNAME stun.eu.demonware.net) 209.170.72.124

Conduit 2

gpcm.gs.nintendowifi.net                   69.10.30.242
gpsp.gs.nintendowifi.net                   69.10.30.241
gamestats.gs.nintendowifi.net              69.10.30.240
gamestats2.gs.nintendowifi.net             69.10.30.234
conduit2wii.available.gs.nintendowifi.net  69.10.30.248
conduit2wii.natneg1.gs.nintendowifi.net    69.10.30.254
conduit2wii.natneg2.gs.nintendowifi.net    69.10.30.253
conduit2wii.natneg3.gs.nintendowifi.net    69.10.30.252
conduit2wii.master.gs.nintendowifi.net     69.10.30.248
conduit2wii.gamestats.gs.nintendowifi.net  69.10.30.240
conduit2wii.gamestats2.gs.nintendowifi.net 69.10.30.234
conduit2wii.ms9.gs.nintendowifi.net        69.10.30.247
naswii.nintendowifi.net                    69.25.139.143  [SSL]
dls1.nintendowifi.net                      49.129.26.161  [SSL]

I don't have the first part of Conduit so I can't check. Actually I remember Conduit 2 with its MotionPlus support to have been the best experience ever when talking about controls in a wii game. And I am still amazed that there seems to be no action regarding the creation of own servers outside of this place and wii-homebrew.

Regarding network capture:
I don't have a switch that supports port mirroring and neither does my router. There's also no custom firmware for it.
So I do it with a "transparent bridge": I have a wired router and a wireless access point and could put the transparent bridge in between the two, monitoring all the traffic going through. If you own the Wii's network adapter, you could actually put the bridge directly between it and your switch/router/modem.
For the bridge I use an old Atom-board with onboard network interface and an additional network interface card. And configured a minimal CentOS to run the bridge and wireshark for me. If desired I can put together a plan on how to do this.
It might also be possible to sniff on your own wireless network but I never tried: http://wiki.wireshark.org/CaptureSetup/WLAN

PS: Big thank you to Toad King and FIX94 for the SSL tunneling and the ocarina code. Works like a charm on Goldeneye.

 

[Videomanman87]

To be honest I wondered if it was possible to determine what was going on without extensive documentation. I had hoped that someone had figured out enough that it didn't matter. But now I have my doubts. Ah well hopefully the documentation can be done. Not sure if I can get a capture system going here as I don't think my router is able, but I will give it a try.

Probably it would be wise to say:
Logged into game ___________
Joined world wide
joined free for all on game
left game
added friend code __________
rejoined free for all
changed weapon
shot 3 times
got killed
respawned
swiched weapon again
ran for a bit
jumped
got killed
respawned
ran
fell off building
respawned
got shot once
shot and killed opponent
etc
Would that be enough? Or would one need exact times of what occurred when as well?

 

[HAARP-GE 007]

I will do more Goldeneye captures this coming weekend ...I want to do a series of captures with starting from a new profile and generating a friend code, adding friends to friends list , play a couple of games with invites and also solo, then deleting friends off the friends list , hopefully with this , plus the other captures i have done , there will be plenty of Goldeneye captures ,
If there is anything more specific that i can capture, or some processes i have missed in previous captures that would be really helpful ...if anyone could point that out or give an opinion what more i could capture i would be very grateful for anyones input , I will Video the game processes also and put the link in the capture Log so it can be viewed

 

[TastyWinnaMon]

Sweet,

I'll do some Animal Crossing: City Folk packet captures some time this week.

 

[leseratte]

@ Videomanman87

I think that's already a bit much. You should focus on server things (what friend code have you got, how much other players, names of other players, ...). The in-game-data is probably p2p and does not need to get analyzed.

 

[Videomanman87]

I just double checked and my router can't do captures. While I have flashed it with DD-WRT it is the micro build (it is the only one that fits on this router) and micro has a few limitations. From what I can tell packet capture/monitor/routing is not supported (IP tables ROUTE target command for example). Drat, if I can get another router I will give packet capture for Conduit 1 and 2 a try. But not sure if I can get another one before May 20th. :/

 

[Videomanman87]

@ Videomanman87

I think that's already a bit much. You should focus on server things (what friend code have you got, how much other players, names of other players, ...). The in-game-data is probably p2p and does not need to get analyzed.

Ahh you are probably right. I thought the sever was mirroring all the data, but it would make sense to just 'connect everyone up' then let them handle the rest. Would be a LOT cheaper bandwidth wise as well. Old multiplayer PC games use to have this as a option. There was the main world wide server, but you could also connect directly if you knew IP numbers.

 

[Wiimm]

As of now I will disable the DNS redirect for ever. I need the servers and the related ports for other tests.

However, you can submit your friend codes using a web formula created by Prof. Eibe.
* http://wiimmfi.profeibe.at/

It makes only sense to enter friend codes for profiles, that have friends. And at least one friend must know the entered friend code also as friend.

The reason is, that there is a way to retrieve the needed profile infos for all friends of a profile, but not for the profile itself. A background process retrieve the friend list and in an next step the friend list of all friends, and so on.

Last not least, this is the discussion thread for the web formula:
* WHB-Forum: Friend code web formula

 

[FootballFan141]

Hey, I found this post through Google because I was looking for the same thing (Wi-Fi after May 20th). If there's anything I can do to help I'd be happy to. I didn't read this whole thread so I'm not sure if this project has been canceled. Hope ya'll can get it working!

 

[THE KHAMELEON]

i found this and i wanna help but i dont have any original games i only have iso and wbfs but i have wbfs manager to turn wbfs to iso hope u guys keep keep this up and also for games like tatsunuko vs capcom the dolphin emulator people have created a server for online play with dolphin and TvC

 

[THE KHAMELEON]

Hi!
I just found the thread, after my brother suggested that we should start capturing packets with wireshark just in case.

Glad to see the progress achieved, congratulations!


I have a few games for the Wii that aren't mentioned here, I could start dumping them, if necesarily. (I have a linksys wr54g with DD-WRT firmware).

The games are:

CoD: Modern Warfare 3 (This I play on an almost daily basis)
Endless Ocean 2 (Never figured out how to go online)
Goldeneye 007 (Never played online)

i have mw3 and blops i have hacked blops with a mod menu

 

[Videomanman87]

You need a DD-WRT flashed router or something smilar. You can check out all the details at http://save-nintendo-wifi.com/ However Wimm's server is no longer available. We need dumps of several games. In short if you don't see yours on the list there, get packet captures for it. Log into the game, add friend codes, delete friend codes, play a game or two. Then send the logs. Of course the more dumps the better. I am hoping that someone can get packet logs of Conduit 1 and 2, fishing resort, endless ocean 1 and 2, Cod: Black Ops, or anything else you play and would like to see preserved.

 

[Wiimm]

Today we have MKWii successfully tested with our own servers:

• Room: GP with 2 players.
• Room: GP with 3 players.
• Room: Coin Collecting with 2 players.
• World wide versus with 2 players.
• World wide versus with 3 players.
• Region battle with 2 players.

The servers are not complete, because adding and removing friends and creating a new profile is not implemented yet.

 

[GHANMI]

There's that DS Wi-fi only Japanese game by Nintendo that can't even boot without multiplayer. And stuff like Takt of Magic. Those really should be salvaged... even though the emulation for those systems is not quite good on that aspect.

 

[eN-t]

There's that DS Wi-fi only Japanese game by Nintendo that can't even boot without multiplayer. And stuff like Takt of Magic. Those really should be salvaged... even though the emulation for those systems is not quite good on that aspect.

Go ahead, dump all the network traffic and analyze it. I'm sure people can make more games compatible with the custom server as long as you do all the work on dumping and analyzing the traffic, just like they did for Mario Kart Wii.

 

[Lakster]

There's that DS Wi-fi only Japanese game by Nintendo that can't even boot without multiplayer. And stuff like Takt of Magic. Those really should be salvaged... even though the emulation for those systems is not quite good on that aspect.

What's the name of that DS game? And I'm already planning on getting some dumps for Takt of Magic. I loved playing LostMagic so I decided to import Takt once I started looking into all the Wi-Fi games.

 

[GHANMI]

What's the name of that DS game? And I'm already planning on getting some dumps for Takt of Magic. I loved playing LostMagic so I decided to import Takt once I started looking into all the Wi-Fi games.

The multiplayer-only DS game would be "Zekkyou Senshi Sakebrain", it's actually a first-party Nintendo release.