Difference between revisions of "WiiConnect24"

From WiiBrew
Jump to: navigation, search
(Added direct link to wc24testboot mail URL.)
(Added link to NANDBOOTINFO used by wc24testboot mail.)
Line 57: Line 57:
 
WC24 can boot titles specified in a NANDBOOTINFO E-Mail attachment. When a message is received with the correct headers, the NANDBOOTINFO attachment is written to NAND. The NANDBOOTINFO attachment is only written to NAND when the system is in idle/"standby" mode. WC24 title booting is normally disabled with the wakeup flag in [[:/shared2/wc24/nwc24msg.cfg]] since that flag is normally zero. The next time STM_Wakeup is called or when sysmenu is booted from idle mode from a normal power "on", the sysmenu is booted to boot the specified title. Before sysmenu boots a title, it modifies NANDBOOTINFO so that it doesn't boot the same title again on next sysmenu boot. When sysmenu modifies NANDBOOTINFO before booting the tiles, it changes NANDBOOTINFO.apptype to 0x40, NANDBOOTINFO.titletype to 0x02, and the normally zero u32 between the argv offsets and the actual arguments is set to 0xFFFFFFFF. NANDBOOTINFO.titletype must be 8, and the argbuf is processed in some unclear way. The title to boot is specified the same way as regular sysmenu title booting, where argv[0] is the titleID in ASCII hex. If a title is specified that doesn't exist on NAND, sysmenu modifies NANDBOOTINFO as described above and shuts down. WC24 title booting can't be used to launch discs, only titles on NAND. The NANDBOOTINFO written by WII_ReturnToSettingsPage can be used with boot mail for loading sysmenu settings. If Nintendo would ever upload boot mail with a NANDBOOTINFO attachment that was written by WII_ReturnToSettingsPage(SETTINGS_UPDATE), eventually KD would turn the Wii "on" and sysmenu would ask if you want to do a system update.
 
WC24 can boot titles specified in a NANDBOOTINFO E-Mail attachment. When a message is received with the correct headers, the NANDBOOTINFO attachment is written to NAND. The NANDBOOTINFO attachment is only written to NAND when the system is in idle/"standby" mode. WC24 title booting is normally disabled with the wakeup flag in [[:/shared2/wc24/nwc24msg.cfg]] since that flag is normally zero. The next time STM_Wakeup is called or when sysmenu is booted from idle mode from a normal power "on", the sysmenu is booted to boot the specified title. Before sysmenu boots a title, it modifies NANDBOOTINFO so that it doesn't boot the same title again on next sysmenu boot. When sysmenu modifies NANDBOOTINFO before booting the tiles, it changes NANDBOOTINFO.apptype to 0x40, NANDBOOTINFO.titletype to 0x02, and the normally zero u32 between the argv offsets and the actual arguments is set to 0xFFFFFFFF. NANDBOOTINFO.titletype must be 8, and the argbuf is processed in some unclear way. The title to boot is specified the same way as regular sysmenu title booting, where argv[0] is the titleID in ASCII hex. If a title is specified that doesn't exist on NAND, sysmenu modifies NANDBOOTINFO as described above and shuts down. WC24 title booting can't be used to launch discs, only titles on NAND. The NANDBOOTINFO written by WII_ReturnToSettingsPage can be used with boot mail for loading sysmenu settings. If Nintendo would ever upload boot mail with a NANDBOOTINFO attachment that was written by WII_ReturnToSettingsPage(SETTINGS_UPDATE), eventually KD would turn the Wii "on" and sysmenu would ask if you want to do a system update.
  
If STM_Wakeup is called when when the system is not in idle/"standby" mode, KD keeps trying to call STM_Wakeup every minute until that's successful, when the wakeup counter system is used with ioctl KD_SetNextWakeup. The next STM_Wakeup call timestamp is stored in [[:/shared2/wc24/misc.bin|/shared2/wc24/misc.bin]]. When boot mail is received, KD increases a timestamp stored in misc.bin by a day in seconds. When KD_Download and KD_CheckMail are run in the background, this timestamp is compared the current UTC time. Normally this timestamp is zero, so when the boot mail is valid, STM_Wakeup would be called the next time either KD_Download or KD_CheckMail are in the background. Usage of WC24 title booting is being tested, with zero success so far. Wc24app from [[libwc24]] SVN can install a boot mail entry, direct link [http://members.iglide.net/ticeandsons/yellowstar/wc24testboot here]. The value of the X-Wii-Cmd must have bit 17(0x20000) set, and (value & 0x00ffffff) - 0x20001 must be <=1. Below is an example header needed to trigger writing the attachment to NANDBOOTINFO:
+
If STM_Wakeup is called when when the system is not in idle/"standby" mode, KD keeps trying to call STM_Wakeup every minute until that's successful, when the wakeup counter system is used with ioctl KD_SetNextWakeup. The next STM_Wakeup call timestamp is stored in [[:/shared2/wc24/misc.bin|/shared2/wc24/misc.bin]]. When boot mail is received, KD increases a timestamp stored in misc.bin by a day in seconds. When KD_Download and KD_CheckMail are run in the background, this timestamp is compared the current UTC time. Normally this timestamp is zero, so when the boot mail is valid, STM_Wakeup would be called the next time either KD_Download or KD_CheckMail are in the background. Usage of WC24 title booting is being tested, with zero success so far. Wc24app from [[libwc24]] SVN can install a boot mail entry, direct link [http://members.iglide.net/ticeandsons/yellowstar/wc24testboot here]. That wc24testboot mail uses this [http://members.iglide.net/ticeandsons/yellowstar/NANDBOOTINFO NANDBOOTINFO] attachment, this would boot HBC. The value of the X-Wii-Cmd must have bit 17(0x20000) set, and (value & 0x00ffffff) - 0x20001 must be <=1. Below is an example header needed to trigger writing the attachment to NANDBOOTINFO:
 
  X-Wii-Cmd: 00020002
 
  X-Wii-Cmd: 00020002
  

Revision as of 00:12, 29 June 2010

Nintendo WiiConnect24 Logo

According to Nintendo,

"WiiConnect24 allows the console to receive downloads even when the
console isn't in active use, as long as it has a working connection
to the Internet."



However, this is an incomplete description, as it fails to explain why there exists a configuration option to enable WC24, but disable "Standby Connect".

WC24 is actually a codename for the /dev/kd driver in IOS that allows the Starlet core to perform network-related tasks when the main CPU (Broadway) is powered off. Only a small fractional of the full functionality of this software is being used -- generally to either download large chunks of data in the background (system updates?) or keep small amounts of data continuously updated (news, weather, friend data in games, etc.)

The kd driver is large -- about 360k -- and makes heavy use of the SSL, SO (socket) and WL / ETH (wireless / Ethernet) drivers; together, this functionality comprises about 75% of the firmware.

Static analysis reveals the following main categories of functionality:

  • Sophisticated task scheduler, including periodic wakeup of either processor for maintenance tasks, and tracking max duty cycle ("Too much wakeup executed recently. Need to wait."), probably used for thermal management
  • Mail engine, for sending and receiving email
  • Real-time clock, with synchronization to a Nintendo-run server (over SSL). When KD syncs time with this server, it converts the date header from the server and sets it to the current UTC time. Time is synced sometimes when KD_Download is executed, it is unknown what triggers time sync from KD_Download exactly. If connecting to the time server fails, KD_Download will abort, return and write a error every time until the connection succeeds.
  • Virtual Machine for running channel scripts ("CHANS"), which are apparently a variant of Javascript. This is used for handling mail meant for certain titles, like handling data sent from a game on a friend's Wii, or from announcement mail with certain headers.
  • This feature was never used by Nintendo: booting a title on NAND via sysmenu with the NANDBOOTINFO file attachment from certain mail, when in idle/"standby" mode.
  • Logging / debug capability, e.g.
13DFA93C                 DCB "This report was sent from Wii to debug your scripts.",0xD,0xA
13DFA93C                                         ; DATA XREF: NWC24WriteLogFile:off_13DB619C�o
13DFA93C                 DCB "The result summary is in the following:",0xD,0xA
13DFA93C                 DCB 0xD,0xA
13DFA93C                 DCB "- General information",0xD,0xA
13DFA93C                 DCB "    WiiConnect24 result code       : %d",0xD,0xA
13DFA93C                 DCB "    Number of committed mail       : %d",0xD,0xA
13DFA93C                 DCB "    VF archive                     : %s",0xD,0xA
13DFA93C                 DCB 0xD,0xA
13DFA93C                 DCB "- Trigger mail information",0xD,0xA
13DFA93C                 DCB "    Application ID                 : 0x%08x [%c%c%c%c]",0xD,0xA
13DFA93C                 DCB "    Group ID                       : 0x%04x [%c%c]",0xD,0xA
13DFA93C                 DCB "    Script parameter               : 0x%02x",0xD,0xA
13DFA93C                 DCB "    Time to live                   : %d",0xD,0xA
13DFA93C                 DCB "    Number of attached file        : %d",0xD,0xA
13DFA93C                 DCB 0xD,0xA
13DFA93C                 DCB "- Virtual machine specific information",0xD,0xA
13DFA93C                 DCB "    Result code of the VM          : %d [%s]",0xD,0xA
13DFA93C                 DCB "    Return value of the script     : 0x%016llx",0xD,0xA
13DFA93C                 DCB "    Last PC                        : 0x%08x",0xD,0xA
13DFA93C                 DCB "    Last line                      : %u",0xD,0xA
13DFA93C                 DCB "    Initial free work size         : %u",0xD,0xA
13DFA93C                 DCB "    Minimum free work size         : %u",0xD,0xA
13DFA93C                 DCB 0xD,0xA
13DFA93C                 DCB "For more information, please see the attached log file.",0xD,0xA
  • Friend list management

Message Board

The message board is a place where you can send and receive messages with other Wiis and email addresses. Games can also put messages here for accomplishments and the like. Channels can also send you updates and Nintendo can alert you when your firmware is ready to be updated. This is handled with the mail engine. Announcements from Nintendo and channels are downloaded with HTTP(S).

WC24 title booting

WC24 can boot titles specified in a NANDBOOTINFO E-Mail attachment. When a message is received with the correct headers, the NANDBOOTINFO attachment is written to NAND. The NANDBOOTINFO attachment is only written to NAND when the system is in idle/"standby" mode. WC24 title booting is normally disabled with the wakeup flag in /shared2/wc24/nwc24msg.cfg since that flag is normally zero. The next time STM_Wakeup is called or when sysmenu is booted from idle mode from a normal power "on", the sysmenu is booted to boot the specified title. Before sysmenu boots a title, it modifies NANDBOOTINFO so that it doesn't boot the same title again on next sysmenu boot. When sysmenu modifies NANDBOOTINFO before booting the tiles, it changes NANDBOOTINFO.apptype to 0x40, NANDBOOTINFO.titletype to 0x02, and the normally zero u32 between the argv offsets and the actual arguments is set to 0xFFFFFFFF. NANDBOOTINFO.titletype must be 8, and the argbuf is processed in some unclear way. The title to boot is specified the same way as regular sysmenu title booting, where argv[0] is the titleID in ASCII hex. If a title is specified that doesn't exist on NAND, sysmenu modifies NANDBOOTINFO as described above and shuts down. WC24 title booting can't be used to launch discs, only titles on NAND. The NANDBOOTINFO written by WII_ReturnToSettingsPage can be used with boot mail for loading sysmenu settings. If Nintendo would ever upload boot mail with a NANDBOOTINFO attachment that was written by WII_ReturnToSettingsPage(SETTINGS_UPDATE), eventually KD would turn the Wii "on" and sysmenu would ask if you want to do a system update.

If STM_Wakeup is called when when the system is not in idle/"standby" mode, KD keeps trying to call STM_Wakeup every minute until that's successful, when the wakeup counter system is used with ioctl KD_SetNextWakeup. The next STM_Wakeup call timestamp is stored in /shared2/wc24/misc.bin. When boot mail is received, KD increases a timestamp stored in misc.bin by a day in seconds. When KD_Download and KD_CheckMail are run in the background, this timestamp is compared the current UTC time. Normally this timestamp is zero, so when the boot mail is valid, STM_Wakeup would be called the next time either KD_Download or KD_CheckMail are in the background. Usage of WC24 title booting is being tested, with zero success so far. Wc24app from libwc24 SVN can install a boot mail entry, direct link here. That wc24testboot mail uses this NANDBOOTINFO attachment, this would boot HBC. The value of the X-Wii-Cmd must have bit 17(0x20000) set, and (value & 0x00ffffff) - 0x20001 must be <=1. Below is an example header needed to trigger writing the attachment to NANDBOOTINFO:

X-Wii-Cmd: 00020002

Mail headers

These Wii mail headers make the msg board or WC24 enable various GUI features and WC24 tasks. This headers can only be used with mail downloaded with WC24, not directly with E-Mail from a computer. X-Wii-MB headers for message board are disabled for mail received from computers via E-Mail, but it's unknown whether it's possible to use the headers that KD uses from computers via mail.

Header Example value Notes
X-Wii-AltName AE4AaQBuAHQAZQBuAGQAbw== When used, the decoded Base64 UTF-16 is used for the sender name on the msg board.(The example value decodes to "Nintendo", without the quotes.)
X-Wii-MB-NoReply 1 Hides the reply button on the msg board.
X-Wii-MB-UpdateSW 1 Enables the "Update" msg board button, which launches the system update from the sysmenu options.
X-Wii-MB-OptOut 1 Enables the "Opt Out" msg board button, which probably deletes all nwc24dl.bin entries and records for the title specified by X-Wii-AppID with type WC24_TYPE_MSGBOARD.
X-Wii-IconNew 524D4345 Enables the "Start" msg board button, which boots the title specified by this header value?
X-WiiFace This is a base64 encoded Mii. After the 56th base64 ASCII character, the rest of the data is split off into a newline with a space before the data.
X-Wii-AppID 3-48414541-3031 First field is parameter of some sort, middle field is titleid low, last field is title group id.
X-Wii-Cmd 00048001 Some cmd header that basically determines what to do this this mail. This can be 00048001 for msg board mail. Other values like 00042019 mean this mail can be processed by CHANS, the title script to use is specified by X-Wii-AppId.
X-Wii-Tag 00001000 Probably some kind of CHANS parameter?
X-Wii-Download-Interval ? Sets the mail entry dl_freq_perday field to the value of this header, see this for the range in the section for the entry flags: /shared2/wc24/nwc24dl.bin It's unknown if this value must be hex or decimal.

CHANS Usage

The CHANS onrecv.kwb script stored in the title's wc24scr.vff under the data directory is used for processing certain mail, which have the X-Wii-Cmd header value set to 00042019. There can also be "public" mail: "public" mail is processed by the onrecvpm.kwb CHANS script in the title's wc24scr.vff. It's unknown what header value makes mail "public". "Normal" mail appears on the msg board, "public" mail doesn't appear on the msg board. For a list of functions used by CHANS, see the CHANS_Reference page. The file storage.bin in wc24scr.vff contains the mail attachment, but CHANS scripts can write to storage.bin as well as read it. The banner scripts used by sysmenu are stored under the same U8 as the other banner files, with filenames banner.cs and icon.cs.

Game List

Wii games using WC24:

  1. Animal Crossing: City Folk
  2. Big Brain Academy: Wii Degree
  3. Blast Works: Build, Trade, Destroy
  4. Boom Blox
  5. Dewy's Adventure
  6. Elebits/Eledees
  7. Jissen Pachi-Slot Pachinko Hisshôhô! Hokuto no Ken Wii
  8. Mario Kart Wii
  9. Marble Saga: Kororinpa
  10. Metroid Prime 3: Corruption
  11. Metroid Prime Trilogy
  12. Pro Evolution Soccer 2008
  13. Super Smash Bros. Brawl
  14. SimCity Creator
  15. Wii Music

WiiWare games using WC24:

  1. Dr. Mario Online Rx
  2. MaBoShi: The Three Shape Arcade
  3. My Aquarium
  4. My Pokémon Ranch
  5. Strong Bad's Cool Game for Attractive People - Episode 1: Homestar Ruiner
  6. Strong Bad's Cool Game for Attractive People - Episode 2: Strong Badia the Free

Channel List

Channels using WC24:

  1. Mii Channel
  2. Forecast Channel
  3. News Channel
  4. Wii Shop Channel
  5. Everybody Votes Channel
  6. Check Mii Out Channel
  7. Mario Kart Wii Channel
  8. Nintendo Channel
  9. Wii Speak Channel

WC24 Errors

These errors are stored in /shared2/wc24/nwc24dl.bin to record the errors of each download content. These errors are also displayed on-screen when software using WC24 to immediately download content fails with a WC24 error. Errors in the 117xxx range seem to be HTTP error/status codes. These errors can be general wifi errors, with the same codes as displayed in Wifi software. Errors in the 1072xx range might be errors from KD_Download, where xx is the retval of KD_Download.

Error code Notes
107243 Invalid wc24dl.vff
107245 RSA signature verification failed. Or KD_CreateRSA failed.
117404 HTTP 404 Not Found
107304 HTTP 304 Not Modified
51030 Access point not in range