Wii/Channel Reverse Engineering Results

Discussion in 'Wii - Hacking' started by AwesomeMarioFan, Mar 6, 2014.

Thread Status:
Not open for further replies.
  1. AwesomeMarioFan
    OP

    AwesomeMarioFan RiiConnect24 Dev

    Member
    162
    27
    Jun 21, 2013
    United States
    Hey Guys,

    I know not many people are active with Wii modding/hacking anymore, but I figured I'd post this in the hopes that someone could use it someday. :) Started this around July of last year, here are the results so far:

    Summary: News Channel is working, you will find a tutorial below with the dumps that someone generously sent me around 6 months ago.

    =============================================
    Information:

    WiiConnect24
    I have extensively looked into/reverse engineered how the Wii transfers data over the network and to what servers it goes to/what it does, and now have a lot of info to post here.
    After seeing logs of my Wii randomly looking for a check.cgi file from Nintendo's WiiConnect24 servers, WC24 seemed to have many scripts, which it seems like the Wii connects to and sends things over, then gets a response. These scripts do things such as check the Wii's version for firmware updates, sending/receiving mail, etc. I'm sure it does a lot more in addition to this, this is just what I have noticed while http logging.

    Ever since WC24 has been shut down, a lot of Wii channels have no longer functioned.
    I however, have found a way to partially bypass this. (More on that below.)

    Note: There is no current way that I know of to re-create a WiiConnect24 server, so some channels may never function properly again.

    So why did Nintendo shut it down?
    I'm not sure why Nintendo would shut down these channels for another 2 years or so even if they were empty (Especially since WiiConnect24 seemed to be most of the backbone of the Wii itself, as many games used it), because it looks like most of the updating was done automatically:
    "Unlike the News Channel, with which its content is provided by many outlets, the Forecast Channel was easier to develop due to only have one source of information." - Nintendo Wikia
    The Wii U has also dropped support for WC24, and it is being succeeded by SpotPass.

    Forecast Channel:
    While using old dumps, it would connect to the DNS server, forward over to the file host server, get an HTTP error 304 not modified when trying to download them and display the error “Unable to retrieve the latest data” (Or something along those lines.) Reinstalling the Forecast Channel seems to download the files on the first run with code 200, however still displays the same error. I even tried changing the creation/modified dates on the dump files to make them look like they were made in the future, so that it was impossible that they were changed, that still didn't work.

    I have recently discovered that using two programs, you are able to extract the .bin file dumps for the weather channel and change the message that is displayed on the screen. I was never able to test this file however because of the following:

    Note For The Forecast Channel: After trying this again currently, the channel seems to never try loading anything and simply errors out. I did not check extensively, but it is possible that Nintendo took down a service required to display the goodbye message on the channel.


    News Channel: Much like the Weather Channel, the New Channel seems to lock you out after the WiiConnect24 ending message is displayed.

    Errors: Any errors that are 17xxx are HTTP errors, so 17404 would be a 404 error.

    Current Status:

    Weather/Forecast Channel: Doesn't work, downloads data then rejects it. (Possibly incorrect dumps/incomplete data, etc. Investigating this.)
    News Channel: Loads and Runs Perfectly. (However, cannot update data in the background due to WiiConnect24 being defunct.)
    Nintendo Channel: I cannot make this work due to the lack of information/dumps from WC24.
    Everyone Votes Channel: This can work without any changes, however no new information is displayed. Doesn't seem to accept dumps. (Edit: I uploaded some archived dumps, but I don't know if I have all of the files.)
    Check Mii Out Channel: Same as the Nintendo Channel, I cannot find enough dumps to work with.

    If anyone has dumps, please submit them so we can get more of these working! :)

    =============================================
    Testing this out on your Wii:

    You can use my DNS server if you would like to see the channels working without setting a web server up yourself, simply do the following:
    1) From the Wii Menu, navigate to Settings, Internet, Connection Settings, your connection, Change Settings, then scroll to the left until your find the DNS page.
    2) Select No, then Advanced, and put in 167.88.119.29 for the primary and secondary DNS.
    3) Download & Run Offline Network Enabler from the Homebrew Channel, and enable your connect. Exit to the Wii Menu.
    4) Try launching one of the channels from the Wii Menu. (NOTES: Make sure that you have WiiConnect24 w/ standby connection enabled, and if you get an error immediately when launching the channel, try re-installing it using the instructions below.)

    =============================================
    Re-installing Channels: To re-install a channel in the case that it instantly errors out, use the following instructions: (NOTE: I will not be responsible for any damage from uninstalling channels on your system.)
    1) Obtain a WAD Manager & the WAD of the channel you are installing via NUSDownloader.
    2) Uninstall the WAD on your Wii, then install it again. (NOTE: Only uninstall the Weather/News/Voting channels, not system titles.)

    =============================================
    Programs & Tutorial:

    Download the Main Dumps: http://awesomemariofan.com/internal/WC24MainDumps.zip (Transfer these to the main/root directory of your web server.)

    You will have to run a DNS server, using a program such as Simple DNS Pro (http://www.simpledns.com/), or named on Linux (Configuration files for Linux are located here: http://awesomemariofan.com/internal/LinuxNamedDNSConfigs.zip - Change 167.88.119.119 to your server's external address). Once this is running, create a new record which takes the following sub-domains and forwards them to a web host:

    News Channel: news.wapp.wii.com
    Weather Channel: weather.wapp.wii.com
    Everybody Votes Channel: vt.wapp.wii.com

    Then, simply point the Wii to the DNS server and launch the channels.
    Note: As mentioned here, the Weather Channel & News Channel seem to lock you out permanently after one failure, so you will most likely have to reinstall the channel for each attempt.

    =============================================
    Other Dumps:
    Incomplete News Channel (See Below) & Weather Channel (Techboy): http://www.mediafire.com/download/dw7ea6id2w7wa6t/WC24Data.zip

    All dumps from the Web Archive (https://web.archive.org), I went through all possible files for the Weather, News, and Everybody Votes Channel (When using these dumps for the News Channel, only use files from /News/Version 2, Version 1 files are for an older channel but there are not enough dumps to work with.): http://awesomemariofan.com/internal/WiiConnect24-
    Archives.zip

    All dumps from after WiiConnect24 ended, these are the dumps with the ending messages: http://awesomemariofan.com/internal/WiiChannelDataDumps.zip

    Weather Channel: [Site]/1/049/[Files]
    The files are forecast.bin and short.bin.

    News Channel: [Site]/v2/1/049/[Files]
    There should be around 20 files. (23 in my dump, not sure if it changes.)


    NOTE: If using Techboy's dumps, there is a missing news.bin.00, you will need to download the second or third archive and grab a news.bin.00 from there. I recommend the second archive, as it is from before WiiConnect24 ended. If you decide to use the second archive, the file will be located somewhere in /News/Version 2, not Version 1.
    EDIT: I changed the path from /v2/1/076 to 049 since that was what my Wii was looking for, even though on WiiBrew they listed the other path.

    Everybody Votes Channel: [Site]/100/[Files] & [Site]/world/[Files]
    I have some dumps for this channel above, however I have not tested them and it is likely that they aren't all there.


    =============================================
    To extract the weather.bin files and change the message displayed:

    - Download the following: http://awesomemariofan.com/internal/WiiConnect24.zip
    (This is a .zip file containing gbalzss.exe, and wc24decrypt.exe, two files which help extract and compile the WiiConnect24 files for editing. WC24Decrypt.exe is not used in this tutorial, but may be useful with other dumps/files.)

    Download this file: http://awesomemariofan.com/internal/WiiChannelDataDumps.zip (Extract the archive, then use the files inside the WCWiiDump folder.)

    Open a command prompt, and enter into the directory with gbalzss.exe inside it. Then, run the following command:
    gbalzss.exe d forecast.bin forecast_extract.bin

    You can then open the resulting forecast.bin with Notepad.exe and you should see the message in plain text. From here, you are able to edit it and run the following command to re-compile the file
    gbalzss.exe e forecast.bin forecast_encrypted.bin

    =============================================
    vWii Instructions (For Everybody Votes Channel) (Not Tested!):
    (Note: We do not currently have full dumps for the Everybody Votes Channel, some can be found here: http://awesomemariofan.com/internal/WiiConnect24-Archives.zip)

    Install ConnectMii & the Everybody Votes Channel WAD (From NUSDownloader) (I would recommend getting the one for your system region, not the one listed for All Regions.)

    DNS - Everybody Votes Channel: vt.wapp.wii.com

    Hosting Location: [Site]/100/[Files] & [Site]/world/[Files]
    I have some dumps for this channel above, however I have not tested them and it is likely that they aren't all there.

    =============================================
    Extracting the Weather Channel Globe:

    - Download the following programs: ShowMiiWADs, wwcxtool, brresviewer (v4 (Black Background), v1.3.1 (Pink Background), NUSDownloader

    - Open NUSDownloader, and download the Weather Channel WAD for your region under System Titles (Note: Don't use the All Regions one, only the one for your region, and make sure you pack it into a WAD!)
    - Once this is done, open up the folder that the WAD was downloaded in, and you should see a file called 00000008.app, this is the file which contains the globe & animations.
    - Open up ShowMiiWADs, and navigate to Tools > Unpack U8 Archive, and select the .app file from earlier. (Note: There are 2 files, 00000008 & 00000008.app, be sure to use the .app as that is the decrypted one from NUSDownloader.)
    - You should then get a file called earth.brres.LZ. Unzip wwcxtool.zip, and open a Command Prompt in the current directory. Run the command 'wwcxtool/u earth.brres.LZ earth.brres.' (Without quotes.)
    - You can then open the resulting file in brresviewer (File > Open). You can then extract it by navigating to File > Extract. (Note: If you are running on an older computer, it may take more time to open the file.)

    The resulting file is: http://awesomemariofan.com/internal/earth.brres

    =============================================

    Nintendo Server Information (Helpful for Running a Local DNS Server):

    ccs.cdn.shop.wii.com - Wii Shop Channel
    ccs.shop.wii.com - Wii Shop Channel
    conntest.nintendowifi.net - WiFi Connection Test, Returns Test HTML Page
    ecs.shop.wii.com - Loaded in the Middle of the Channel Load Process (Wii Shop Channel)
    entu.wapp.wii.com - I believe this has to do with downloading channels from the shop channel.
    miicontest.wapp.wii.com - (Now Defunct) - Check Mii Out Channel Main Server
    mtw.wc24.wii.com - (Now Defunct) - WC24 Mail Server
    news.wapp.wii.com - (Now Defunct) - New Channel Server
    oss-auth.shop.wii.com - Wii Shop Channel
    rcw.wc24.wii.com - (Now Defunct) - Contains the Check.CGI Script.
    vt.wapp.wii.com - (Now Defunct) - Everybody Votes Channel?
    vtp.wapp.wii.com - (Now Defunct) - Everybody Votes Channel Main Server
    weather.wapp.wii.com - (Now Defunct) - Weather Channel Server
    wiinet.available.gs.nintendowifi.net - Shows up during connection test, however doesn't seem to be a required part of the successful connection message.
    wiinat.natneg1.gs.nintendowifi.net - Same as Above
    wiinat.natneg2.gs.nintendowifi.net - Same as Above
    wiinat.natneg3.gs.nintendowifi.net - Same as Above
    nus.shop.wii.com - Deals with NUS/Wii Updates
    mail.wc24.wii.com - (Now Defunct) - Contains Mail Scripts/Mail Engine
    mtw.wc24.wii.com - (Now Defunct) - Contains WC24 Scripts, Handled Idle Updating

    Technical Stuff Below: (I'll leave it here for people who want it.)
    It is mostly just random stuff I found while testing the above.

    Weather Channel Information:
    Using dumps from 2007: Returns Error 107245 ("RSA signature verification failed. Or KD_CreateRSA failed.") (Maybe bad dumps?)
    Using Dumps from June 21st 2013: Error FORE000006 ("Unable to download the latest information.")

    News Channel:
    Successfully downloads the files and displays them.

    WiiConnect24:
    Every once in a while I see the Wii making (Or trying at least) to connect to mtw.wc24.wii.com:443. (This obviously returns HTTP Error 502 since the WC24 servers are down.)

    Channel Connections and User Agents:
    (Italics denotes the connection messages on the Wii’s screen.)
    [Before all connections:]
    4493 200 HTTP Tunnel to [URL Here]

    --- Idle WiiConnect24 Check
    POST /cgi-bin/check.cgi HTTP/1.1
    mlchkid=4f02b532ed8d590271c304e7297acf26
    chlng=dff1a0b57242dfdb9afce3373f9228c7
    CONNECT mtw.wc24.wii.com:443 HTTP/1.1
    HTTP/1.1 502 Fiddler - DNS Lookup Failed
    Host: mtw.wc24.wii.com:443
    User-Agent: WiiConnect24/2.0.3.1
    Host: rcw.wc24.wii.com

    --- Random Message Board Check
    CONNECT mtw.wc24.wii.com:443 HTTP/1.1
    Host: mtw.wc24.wii.com:443
    HTTP/1.1 502 Fiddler - DNS Lookup Failed
    Content-Type: text/html; charset=UTF-8

    --- News Channel
    GET /v2/1/049/news.bin.[00-23] HTTP/1.1
    User-Agent: WiiConnect24/2.0.3.1
    Host: news.wapp.wii.com

    --- Nintendo Channel
    - Receiving Data -
    GET /6/US/en/csdata.LZ HTTP/1.1
    Host: entu.wapp.wii.com
    - Stops Downloading/Sending at this Point -

    --- Weather Channel
    GET /1/049/short.bin HTTP/1.1
    GET /1/049/forecast.bin HTTP/1.1
    User-Agent: WiiConnect24/2.0.3.1
    Host: weather.wapp.wii.com

    --- Check Mii Out Channel
    GET /first/49.ces HTTP/1.1
    X-APPVER: 2008/01/23 14:01 UF
    Host: miicontest.wapp.wii.com

    --- Everyone Votes Channel
    - Reading Data -
    - Receiving Data -
    (Sometimes) CONNECT vtp.wapp.wii.com:443 HTTP/1.1
    Host: vtp.wapp.wii.com:443
    GET /049/voting.bin HTTP/1.1
    User-Agent: WiiConnect24/2.0.3.1

    --- YouTube
    CONNECT naswii.nintendowifi.net:443 HTTP/1.1
    Host: naswii.nintendowifi.net:443
    CONNECT www.youtube.com:443 HTTP/1.1
    HTTP/1.1 200 Connection Established (Appears for all connections.)
    CONNECT s.ytimg.com:443 HTTP/1.1
    User-Agent: Mozilla/5.0 (Nintendo Wii; U; PowerPC; en) LeanbackLite/v4 YouTube/2.1
    CONNECT www.youtube.com:443 HTTP/1.1
    CONNECT youtube.googleapis.com:443 HTTP/1.1
    CONNECT i1.ytimg.com:443 HTTP/1.1
    CONNECT s.ytimg.com:443 HTTP/1.1 (x3)

    --- Mario Kart Wii Channel
    CONNECT naswii.nintendowifi.net:443 HTTP/1.1
    Host: naswii.nintendowifi.net:443
    HTTP/1.1 200 Connection Established

    --- Wii Shop Channel
    - Loading Screen -
    CONNECT oss-auth.shop.wii.com:443 HTTP/1.0 (x3)
    User-Agent: Opera/9.30 (Nintendo Wii; U; ; 2077-4; Wii Shop Channel/21.0(A); en) (x3)
    Host: oss-auth.shop.wii.com:443 (x3)
    HTTP/1.0 200 Connection Established (x3)
    ClientToServerBytes: 4770 (Changes Between 1-3)
    CONNECT ecs.shop.wii.com:443 HTTP/1.1
    Host: ecs.shop.wii.com:443
    HTTP/1.1 200 Connection Established
    - Connecting -
    CONNECT oss-auth.shop.wii.com:443 HTTP/1.0 (x2)
    User-Agent: Opera/9.30 (Nintendo Wii; U; ; 2077-4; Wii Shop Channel/21.0(A); en)
    Host: oss-auth.shop.wii.com:443
    HTTP/1.0 200 Connection Established

    Idle WC24 Updates:

    (Weather Channel)
    GET /1/049/forecast.bin HTTP/1.1
    User-Agent: WiiConnect24/2.2.255.0
    Host: weather.wapp.wii.com
    OR
    (Weather Channel 2)
    GET /1/049/short.bin HTTP/1.1
    User-Agent: WiiConnect24/2.0.3.1
    Host: weather.wapp.wii.com

    (News Channel)
    GET /v2/1/049/news.bin.23 HTTP/1.1
    User-Agent: WiiConnect24/2.2.255.0
    Host: news.wapp.wii.com

    Some WC24 Scripts:
    https://amw.wc24.wii.com/cgi-bin/account.cgi (Secured) (Wii Shop Channel)
    http://rcw.wc24.wii.com/cgi-bin/check.cgi (Not Secured) (Now Defunct)
    https://mtw.wc24.wii.com/cgi-bin/receive.cgi (Mail) (Now Defunct)
    https://mtw.wc24.wii.com/cgi-bin/delete.cgi (Mail) (Now Defunct)
    https://mtw.wc24.wii.com/cgi-bin/send.cgi (Mail) (Now Defunct)

    From the above mail scripts, it looks to me that the Wii in fact does not send emails, but rather sends the subject, message, etc. to Nintendo’s servers to then send the message.

    Extras:

    System Menu HTML Elements:
    Link 1: http://web.archive.org/web/20080924...lsetting.ash/FIX/US/ENG/Setup/ScreenSave.html
    Link 2: http://web.archive.org/web/20081014...ting.ash/FIX/US/ENG/Setup/startup_index1.html
    Link 3: http://web.archive.org/web/20081013...gs/US2/iplsetting.ash/FIX/US/ENG/index01.html

    ====================================================

    If anyone needs help with the tutorial, please post below and I will be happy to help!

    Thanks,
    ~ AwesomeMarioFan
     


  2. HNKii

    HNKii GBAtemp Fan

    Member
    447
    70
    Jan 28, 2014
    Switzerland
    Mario Kart Wii-DS Link Play Stadium
    Thanks a million!
     
  3. whatupdog

    whatupdog Member

    Newcomer
    22
    8
    Nov 14, 2013
    United States
    Great work on this. I have a feeling that in the coming years all wii functions will be commandeered by the home-brew community.
     
  4. masterpad

    masterpad Advanced Member

    Newcomer
    84
    6
    Aug 26, 2008
    Cameroon
    :yaywii: :yaynds: :nds: :sp: :yaysp: :hateit: :yaysp: :yayu:
     
    Margen67 likes this.
  5. HNKii

    HNKii GBAtemp Fan

    Member
    447
    70
    Jan 28, 2014
    Switzerland
    Mario Kart Wii-DS Link Play Stadium
    Here's my idea of sort of re-enabling the data transfer using WC24:
    use a Homebrew that can Dump and Write Wii message board data, also try to patch some games(or the system menu)so that they can post their messages(or other stuff in the current console's message board instead of having to be a friend's)
     
  6. leseratte

    leseratte GBAtemp Regular

    Member
    132
    15
    Jun 2, 2012
    Gambia, The
  7. Larsenv

    Larsenv RiiConnect24 Developer

    Member
    529
    426
    Sep 28, 2013
    United States
    Texas
    Hi,
    Thank you a lot for this.
    To get the 2007 Weather Channel Dumps to work, maybe you can try using Wii Mod Or Multi Mod Manager to install V3 of the Weather Channel From NUS.
    That's useful because it's older and the version was probably used around that time period it was dumped...
    Hope that helps.
     
  8. HNKii

    HNKii GBAtemp Fan

    Member
    447
    70
    Jan 28, 2014
    Switzerland
    Mario Kart Wii-DS Link Play Stadium
    The v3 is an all region one that doesn't do anything when the region specific one is present.(V3 HAFA is avaliable in latest system update)
    AFAIK, the weather channel can display the discontinue message w/o the v3 region free one.
    However, your point is right. We might try using a v6 weather channel.
     
    Larsenv likes this.
  9. Larsenv

    Larsenv RiiConnect24 Developer

    Member
    529
    426
    Sep 28, 2013
    United States
    Texas
    Yeah, it matters what his version was.
    HNKii, from your previous post about the Wii Message Board, there is for Wii Homebrew coders a library called libwc24 (Wii Connect 24,) wonder if that could be used to make a Wii Homebrew Application so we can make these channels work again...
     
  10. leseratte

    leseratte GBAtemp Regular

    Member
    132
    15
    Jun 2, 2012
    Gambia, The
    I now tried your news channel files, but there is no "news.bin.00" which is requested by the Wii.
    I've copied the "news.bin.01" to "news.bin.00" and now the Wii downloads all 24 files, but there is error "NEWS000006". What am I doing wrong?
     
  11. AwesomeMarioFan
    OP

    AwesomeMarioFan RiiConnect24 Dev

    Member
    162
    27
    Jun 21, 2013
    United States
    I've made a few edits above with information after some more testing and cleaned up the thread.
    You can get the news.bin.00 file from here: http://awesomemariofan.com/internal/WiiConnect24-Archives.zip, once downloaded there should be a News folder, and inside that a Version 2 folder.

    Also, the path for me seems to be /v2/1/049 instead of 076 as stated by WiiBrew, were you getting the same results?
     
  12. OriginalHamster

    OriginalHamster UStealthy

    Member
    3,381
    641
    Nov 2, 2008
    Cote d'Ivoire
    Can you install the News Channel on vWii (Wii U)?
     
  13. Larsenv

    Larsenv RiiConnect24 Developer

    Member
    529
    426
    Sep 28, 2013
    United States
    Texas
    OK, the News Channel works for me, I just tried it to restore those memories of the channel.
    At the top, it says Updated 10027:41 ago, yeah, that's pretty recent :yay:
     
  14. AwesomeMarioFan
    OP

    AwesomeMarioFan RiiConnect24 Dev

    Member
    162
    27
    Jun 21, 2013
    United States
    I cleaned up the thread a bit a few days ago so the instructions should be easier.
    Even if you could install it via the WAD file, it wouldn't work because the Wii U doesn't have WiiConnect24 support, so the channel would just error out when it launches. Also, the Wii stores it in a special part of the memory so that it doesn't effect the block count, so I'm not sure how this would go on the Wii U. I don't recommend trying to install it though for those reasons.
    Yeah I thought that was funny haha :) Glad you got it working!
     
  15. Larsenv

    Larsenv RiiConnect24 Developer

    Member
    529
    426
    Sep 28, 2013
    United States
    Texas
    Actually, you can probably use this on vWii with something called ConnectMii that edited the vWii settings to enable WiiConnect24 which made the News and Everybody Votes Channels work on vWii when the servers were still alive thanks to JoostinOnline Here's the link:
    www.mediafire.com/?v0mjv745dfu7q1r
    You edit the DNS Settings on the Wii U Settings.
     
  16. AwesomeMarioFan
    OP

    AwesomeMarioFan RiiConnect24 Dev

    Member
    162
    27
    Jun 21, 2013
    United States
    Awesome! I'm not sure if this would work however because of the second reason I posted before, but I've messaged JoostinOnline to ask if that would work. Waiting for a response from him.
     
  17. drfsupercenter

    drfsupercenter Flash Cart Aficionado

    Member
    1,896
    234
    Mar 26, 2008
    United States
    Surprised I haven't seen this thread earlier... I've got a modded Wii with all the original channels, if you want more "dumps", not sure what exactly you're looking for but I could send you the entire NAND dump from bootMii if it helps!
     
  18. AwesomeMarioFan
    OP

    AwesomeMarioFan RiiConnect24 Dev

    Member
    162
    27
    Jun 21, 2013
    United States
    We were referring to dumps of the data transferred from Nintendo's network to Wiis.
    JoostinOnline said they should all work, however I was unable to get the Weather/News Channels to work. I'm assuming the Everybody Votes Channel will though.

    I will update the instructions above to add vWii stuff. (OriginalHamster)

    I also managed to view the Weather Globe from the channel! (For anyone who's interested it's in the 00000008.app file from the WAD, you can download it from NUSDownloader.)
    http://awesomemariofan.com/screens/20140819155118.png
     
  19. JoostinOnline

    JoostinOnline Certified Crash Test Dummy

    Member
    10,926
    3,700
    Apr 2, 2011
    United States
    The Twilight Zone
    I guess I was wrong. My memory isn't great though. I had to look up our conversation to figure out what you were even talking about, lol.
     
  20. AwesomeMarioFan
    OP

    AwesomeMarioFan RiiConnect24 Dev

    Member
    162
    27
    Jun 21, 2013
    United States
    Updated the thread w/ more information on the Weather Channel Earth model file.
     
Thread Status:
Not open for further replies.