Hacking Save Nintendo WiFi - A project to save online servers for Wii (and DS) games

[Startropic1]

Does this project have a solution for Jump Superstars/Jump Ultimate Stars on DS? These are 2 games that people will definitely want to continue playing.

 

[AwesomeMarioFan]

Does this project have a solution for Jump Superstars/Jump Ultimate Stars on DS? These are 2 games that people will definitely want to continue playing.

I'm not sure Wiimm is logging those yet, once he does though you can use his DNS on your DS to capture packets for that game later.

 

[Wiimm]

I log the complete traffic, that is redirected over my servers. That's the reason for the redirection.

BUT ...
... the many different games use many different domain names and my server is only redirecting some of them. So it is inescapable that the users will dump the complete traffic of the own DS/Wii if playing online.

Read this: http://wiki.tockdom.com/wiki/Dumping_Network_Traffic

 

[HNKii]

I log the complete traffic, that is redirected over my servers. That's the reason for the redirection.

BUT ...
... the many different games use many different domain names and my server is only redirecting some of them. So it is inescapable that the users will dump the complete traffic of the own DS/Wii if playing online.

Read this: http://wiki.tockdom.com/wiki/Dumping_Network_Traffic

Some data that has failed to be dumped:
My 6 Dr.Mario Online Rx Friend Codes(One of them has played against others, while the others just connected once)
3 Excited Bike: World Tour Friend Codes

Street Fighter Genesis VC(ID MC3E)
Puyo Puyo VC Arcade(ID E5YJ)

 

[Laxivation]

I have been following this thread for awhile and have worked with packet capture for the ps2 before. If nintendo wifi connection uses gamespy type servers, someone made a pretty functional replacement called openspy. http://www.openspy.net/

 

[Wiimm]

A few minutes ago I have reconfigured the DNS server to catch more traffic of other games:

DNS: Capture more data

Mario Kart Wii uses the server mariokartwii.ms19.gs.nintendowifi.net to connect to port 28910. This is a gamespy server. It is used to manage online meetings.

In general, Nintendo uses <GAME>.ms<NUMBER>.gs.nintendowifi.net for this the gamespy database queries to port 28910. <GAME> is any internal game name, ore more exact, any possible domain string (wildcard domains). <NUMBER> are numbers between 0 and 20. And all domain names are resolved to the IP4 69.10.30.247.

Since last weekend, the name server redirects mariokartwii.ms19.gs.nintendowifi.net to my server. This disadvantage of this solution is, that only MKWii traffic is redirected. But beginning with the next week, I will redirect all of the *.ms<NUMBER>.gs.nintendowifi.net domains to catch the traffic of other games. This might be dangerous, if the domains are used for other purposes.

So, if you have problems, disable the DNS server and tell me, what happened. I will post a second message when I have changed the settings.

* See also: A redirect Server

Btw:
I have now completely analysed the MKWii part of protocol of this server. Decoding is no problem, and the encoder must be tested in the next days. mkw-ana print nice statistical summaries. In the next days I will tell you more.

 

[Wiimm]

@moderators:
At the moment this is the most important hacking topic. So please make it sticky!

If done, remove my post.

 

[Wiimm]

Now it is very clear. If any player wants to use his old profile(s), he must sue the DNS server settings at least once. The reason is very easy: Only the server side database knows the relation between the NICKNAME and the FC. And for our own server we must have this information. If using the DNS redirection, both are dumped.

And yes, I know, that we can also get the infos directly from the servers using a retrieving tool like gslist, And some retrieve the data already. But we have >400 Millions of friend codes and the chance to miss your code is high.

 

[uyjulian]

Does Game Spy servers use an exploitable version of OpenSSL?

See: http://heartbleed.com/

 

[Laxivation]

Now it is very clear. If any player wants to use his old profile(s), he must sue the DNS server settings at least once. The reason is very easy: Only the server side database knows the relation between the NICKNAME and the FC. And for our own server we must have this information. If using the DNS redirection, both are dumped.

And yes, I know, that we can also get the infos directly from the servers using a retrieving tool like gslist, And some retrieve the data already. But we have >400 Millions of friend codes and the chance to miss your code is high.

Does this mean that friends codes will only work if you use the dns before the servers go offline or is that just to maintain current profiles?

 

[HAARP-GE 007]

Now it is very clear. If any player wants to use his old profile(s), he must sue the DNS server settings at least once. The reason is very easy: Only the server side database knows the relation between the NICKNAME and the FC. And for our own server we must have this information. If using the DNS redirection, both are dumped.

And yes, I know, that we can also get the infos directly from the servers using a retrieving tool like gslist, And some retrieve the data already. But we have >400 Millions of friend codes and the chance to miss your code is high.

Is there still no solution for the 3rd party games such as Activision's Goldeneye 007 ?

 

[leseratte]

julialy: Well, I don't think we should work on this. This would take too much time for too less results, as we already know how the SSL-loginserver works.

Laxivation: If you want to keep your old profile / friend code you need to use the DNS-server at least once. If you don't care about your friend code and your save game (you have to delete your MKWii profile to get a new friend code), you can get a new friend code without having to use the DNS server.

 

[Videomanman87]

Impossible to save Monster Hunter 3, true?

I just realized this thread, a little late

Actually there is a project to bring back Monster Hunter Tri online. http://sufami.org/

 

[Toad King]

Does Game Spy servers use an exploitable version of OpenSSL?

See: http://heartbleed.com/

Doesn't look like it does, it's probably using Windows Server judging by other GameSpy servers so it wouldn't use OpenSSL. Also, using that to steal the server's private key is probably very illegal no matter the reason. Unless there's an exploit in their SSL library on the game side, there won't be a way around having to patch your game.

 

[HNKii]

DNS: Capture more data

Mario Kart Wii uses the server mariokartwii.ms19.gs.nintendowifi.net to connect to port 28910. This is a gamespy server. It is used to manage online meetings.

In general, Nintendo uses <GAME>.ms<NUMBER>.gs.nintendowifi.net for this the gamespy database queries to port 28910. <GAME> is any internal game name, ore more exact, any possible domain string (wildcard domains). <NUMBER> are numbers between 0 and 20. And all domain names are resolved to the IP4 69.10.30.247.

Since last weekend, the name server redirects mariokartwii.ms19.gs.nintendowifi.net to my server. This disadvantage of this solution is, that only MKWii traffic is redirected. But beginning with the next week, I will redirect all of the *.ms<NUMBER>.gs.nintendowifi.net domains to catch the traffic of other games. This might be dangerous, if the domains are used for other purposes.

So, if you have problems, disable the DNS server and tell me, what happened. I will post a second message when I have changed the settings.

* See also: A redirect Server

Btw:
I have now completely analysed the MKWii part of protocol of this server. Decoding is no problem, and the encoder must be tested in the next days. mkw-ana print nice statistical summaries. In the next days I will tell you more.

KDM is the Mario VS DK Dsi ware(Minis March Again)

 

[uyjulian]

Doesn't look like it does, it's probably using Windows Server judging by other GameSpy servers so it wouldn't use OpenSSL. Also, using that to steal the server's private key is probably very illegal no matter the reason. Unless there's an exploit in their SSL library on the game side, there won't be a way around having to patch your game.

Ah,okay thank you.

 

[HNKii]

Is there any way to get in the server and grab all Gamespy cloud stored contents at once? I wanted to preserve all Mario VS. DK Mini Land Mayhem but downloading levels one by one is really a pain D:

 

[QuuX]

No Love for fortune street?

http://forum.wii-homebrew.com/wii-server/statistics.txt

I just played 2 bouts and don't see it on the list?

 

[AwesomeMarioFan]

Is there any way to get in the server and grab all Gamespy cloud stored contents at once? I wanted to preserve all Mario VS. DK Mini Land Mayhem but downloading levels one by one is really a pain D:

Unfortunately no, I'll try to explain as best as I can.
On Nintendo's side as far as I know, they have scripts that generate numbers, etc. for connecting and stuff. When the Wii sends these out, it usually uses arguments (ex. get.nintendo.com/get.php[args-here]).
When navigating to this URL in the web browser from a computer, it will simply display the output from the script, not the script generation code itself.

 

[Gameboy Color]

Would appreciate if you guys logged Phantasy Star 0 for NDS.

It's really important wifi DS game since it supports 4 player co-op online.

And Final Fantasy Crystal Chronicles: Echoes of Time for NDS (This game is also on the Wii too and is multi-platform)

Another 4 player great game online co-op.