WiiConnect24

From WiiBrew
Jump to: navigation, search
Nintendo WiiConnect24 Logo

According to Nintendo,

"WiiConnect24 allows the console to receive downloads even when the
console isn't in active use, as long as it has a working connection
to the Internet."



However, this is an incomplete description, as it fails to explain why there exists a configuration option to enable WC24, but disable "Standby Connect".

WC24 is actually a codename for the /dev/kd driver in IOS that allows the Starlet core to perform network-related tasks when the main CPU (Broadway) is powered off. Only a small fractional of the full functionality of this software is being used -- generally to either download large chunks of data in the background (system updates?) or keep small amounts of data continuously updated (news, weather, friend data in games, etc.)

The kd driver is large -- about 360k -- and makes heavy use of the SSL, SO (socket) and WL / ETH (wireless / Ethernet) drivers; together, this functionality comprises about 75% of the firmware.

Static analysis reveals the following main categories of functionality:

  • Sophisticated task scheduler, including periodic wakeup of either processor for maintenance tasks, and tracking max duty cycle ("Too much wakeup executed recently. Need to wait."), probably used for thermal management
  • Mail engine, for sending and receiving email
  • Real-time clock, with synchronization to a Nintendo-run server (over SSL). When KD syncs time with this server, it converts the date header from the server and sets it to the current UTC time. Time is synced sometimes when KD_Download is executed, it is unknown what triggers time sync from KD_Download exactly. If connecting to the time server fails, KD_Download will abort, return and write a error every time until the connection succeeds.
  • Virtual Machine for running channel scripts ("CHANS"), which are apparently a variant of Javascript. This is used for handling mail meant for certain titles, like handling data sent from a game on a friend's Wii, or from announcement mail with certain headers.
  • This feature was never used by Nintendo: booting a title on NAND via sysmenu with the NANDBOOTINFO file attachment from certain mail, when in idle/"standby" mode.
  • Logging / debug capability, e.g.
13DFA93C                 DCB "This report was sent from Wii to debug your scripts.",0xD,0xA
13DFA93C                                         ; DATA XREF: NWC24WriteLogFile:off_13DB619C�o
13DFA93C                 DCB "The result summary is in the following:",0xD,0xA
13DFA93C                 DCB 0xD,0xA
13DFA93C                 DCB "- General information",0xD,0xA
13DFA93C                 DCB "    WiiConnect24 result code       : %d",0xD,0xA
13DFA93C                 DCB "    Number of committed mail       : %d",0xD,0xA
13DFA93C                 DCB "    VF archive                     : %s",0xD,0xA
13DFA93C                 DCB 0xD,0xA
13DFA93C                 DCB "- Trigger mail information",0xD,0xA
13DFA93C                 DCB "    Application ID                 : 0x%08x [%c%c%c%c]",0xD,0xA
13DFA93C                 DCB "    Group ID                       : 0x%04x [%c%c]",0xD,0xA
13DFA93C                 DCB "    Script parameter               : 0x%02x",0xD,0xA
13DFA93C                 DCB "    Time to live                   : %d",0xD,0xA
13DFA93C                 DCB "    Number of attached file        : %d",0xD,0xA
13DFA93C                 DCB 0xD,0xA
13DFA93C                 DCB "- Virtual machine specific information",0xD,0xA
13DFA93C                 DCB "    Result code of the VM          : %d [%s]",0xD,0xA
13DFA93C                 DCB "    Return value of the script     : 0x%016llx",0xD,0xA
13DFA93C                 DCB "    Last PC                        : 0x%08x",0xD,0xA
13DFA93C                 DCB "    Last line                      : %u",0xD,0xA
13DFA93C                 DCB "    Initial free work size         : %u",0xD,0xA
13DFA93C                 DCB "    Minimum free work size         : %u",0xD,0xA
13DFA93C                 DCB 0xD,0xA
13DFA93C                 DCB "For more information, please see the attached log file.",0xD,0xA
  • Friend list management

Message Board

The message board is a place where you can send and receive messages with other Wiis and email addresses. Games can also put messages here for accomplishments and the like. Channels can also send you updates and Nintendo can alert you when your firmware is ready to be updated. This is handled with the mail engine. Announcements from Nintendo and channels are downloaded with HTTP(S).

WC24 title booting

WC24 can boot titles specified in a NANDBOOTINFO E-Mail attachment. When a message is received with the correct headers, the NANDBOOTINFO attachment is written to NAND. The NANDBOOTINFO attachment is only written to NAND when the system is in idle/"standby" mode. This only works with WC24 HTTP(S) mail, not direct mail with the mail engine. WC24 title booting is normally disabled with the wakeup flag in /shared2/wc24/nwc24msg.cfg since that flag is normally zero. The next time STM_Wakeup is called, the sysmenu is booted to boot the specified title. When this is used with boot mail, STM_Wakeup is called immediately after KD_ProcessMail is executed when the boot mail was processed. When in idle mode, KD deletes the mail from wc24recv.mbx before calling STM_Wakeup for boot mail. If the system is "on" when boot mail is processed, the NANDBOOTINFO won't be written to NAND but the mail won't be deleted. KD will keep trying to process the mail until in idle mode. Before sysmenu boots a title, it modifies NANDBOOTINFO so that it doesn't boot the same title again on next sysmenu boot. When sysmenu modifies NANDBOOTINFO before booting the tiles, it changes NANDBOOTINFO.apptype to 0x40, NANDBOOTINFO.titletype to 0x02, and the normally zero u32 between the argv offsets and the actual arguments is set to 0xFFFFFFFF. NANDBOOTINFO.titletype must be 8, and the argbuf is processed in some unclear way. The title to boot is specified the same way as regular sysmenu title booting, where argv[0] is the titleID in ASCII hex. If a title is specified that doesn't exist on NAND, sysmenu modifies NANDBOOTINFO as described above and shuts down. WC24 title booting can't be used to launch discs, only titles on NAND.

The next STM_Wakeup call timestamp is stored in /shared2/wc24/misc.bin. When boot mail is received, KD increases a timestamp stored in misc.bin by 24-hours in seconds. When KD_Download and KD_CheckMail are run in the background, this timestamp is compared the current UTC time. When boot mail was never used before this timestamp is zero. This seems to be reset to zero by sysmenu when title booting is used, however it's unknown what it checks for when clearing this. Wc24app from libwc24 SVN can install a boot mail entry, direct link here. That wc24testboot mail uses this NANDBOOTINFO attachment, this would boot HBC. The mail content for the entry that wc24app can install has the first field in the X-Wii-AppID header set to 1, so that sysmenu ignores the mail, so it doesn't break the boot mail by moving it to cdb.vff. The value of the X-Wii-Cmd must have bit 17(0x20000) set, and (value & 0x00ffffff) - 0x20001 must be <=1. Below is example headers needed to trigger writing the attachment to NANDBOOTINFO:

X-Wii-Cmd: 00020002
X-Wii-AppID: 1-AF1BF516-4842

Mail headers

These Wii mail headers make the msg board or WC24 enable various GUI features and WC24 tasks. These headers can only be used with mail downloaded with WC24, not directly with E-Mail from a computer. X-Wii-MB headers for message board are disabled for mail received from computers via E-Mail, but it's unknown whether it's possible to use the headers that KD uses from computers via mail. WC24 title booting mail can't be sent directly from an E-Mail address, KD ignores the X-Wii-Cmd and X-Wii-AppID headers.

Header Example value Notes
X-Wii-AltName AE4AaQBuAHQAZQBuAGQAbw== When used, the decoded Base64 UTF-16 is used for the sender name on the msg board.(The example value decodes to "Nintendo", without the quotes.)
X-Wii-MB-NoReply 1 Hides the reply button on the msg board.
X-Wii-MB-UpdateSW 1 Enables the "Update" msg board button, which launches the system update from the sysmenu options.
X-Wii-MB-OptOut 1 Enables the "Opt Out" msg board button, which probably deletes all nwc24dl.bin entries and records for the title specified by X-Wii-AppID with type WC24_TYPE_MSGBOARD.
X-Wii-IconNew 524D4345 Enables the "Start" msg board button, which boots the title specified by this header value?
X-WiiFace This is a base64 encoded Mii. After the 56th base64 ASCII character, the rest of the data is split off into a newline with a space before the data.
X-Wii-AppID 3-48414541-3031 First field is parameter of some sort, middle field is titleid low, last field is title group id. Sysmenu ignores the mail when the first field is 1. Normally type 1(first field) is used for games mail sent between Wiis so that the games can manually process the mail directly without CHANS. This type is also used with the boot mail content entry installable by wc24app, so that sysmenu doesn't interfere and break WC24 title booting by moving the mail to cdb.vff.
X-Wii-Cmd 00048001 Some cmd header that basically determines what to do this this mail. This can be 00048001 for msg board mail. Other values like 00042019 mean this mail can be processed by CHANS, the title script to use is specified by X-Wii-AppId.
X-Wii-Tag 00001000 Probably some kind of CHANS parameter?
X-Wii-Download-Interval ? Sets the mail entry dl_freq_perday field to the value of this header, see this for the range in the section for the entry flags: /shared2/wc24/nwc24dl.bin It's unknown if this value must be hex or decimal.

CHANS Usage

The CHANS onrecv.kwb script stored in the title's wc24scr.vff under the data directory is used for processing certain mail, which have the X-Wii-Cmd header value set to 00042019. There can also be "public" mail: "public" mail is processed by the onrecvpm.kwb CHANS script in the title's wc24scr.vff. It's unknown what header value makes mail "public". "Normal" mail appears on the msg board, "public" mail doesn't appear on the msg board. For a list of functions used by CHANS, see the CHANS_Reference page. The file storage.bin in wc24scr.vff contains the mail attachment, but CHANS scripts can write to storage.bin as well as read it. The banner scripts used by sysmenu are stored under the same U8 as the other banner files, with filenames banner.cs and icon.cs.

Game List

Wii games using WC24:

  1. Animal Crossing: City Folk
  2. Big Brain Academy: Wii Degree
  3. Blast Works: Build, Trade, Destroy
  4. Boom Blox
  5. Dewy's Adventure
  6. Elebits/Eledees
  7. Jissen Pachi-Slot Pachinko Hisshôhô! Hokuto no Ken Wii
  8. Mario Kart Wii
  9. Marble Saga: Kororinpa
  10. Metroid Prime 3: Corruption
  11. Metroid Prime Trilogy
  12. Pro Evolution Soccer 2008
  13. Super Smash Bros. Brawl
  14. SimCity Creator
  15. Wii Music

WiiWare games using WC24:

  1. Dr. Mario Online Rx
  2. MaBoShi: The Three Shape Arcade
  3. My Aquarium
  4. My Pokémon Ranch
  5. Strong Bad's Cool Game for Attractive People - Episode 1: Homestar Ruiner
  6. Strong Bad's Cool Game for Attractive People - Episode 2: Strong Badia the Free

Channel List

Channels using WC24:

  1. Mii Channel
  2. Forecast Channel
  3. News Channel
  4. Wii Shop Channel
  5. Everybody Votes Channel
  6. Check Mii Out Channel
  7. Mario Kart Wii Channel
  8. Nintendo Channel
  9. Wii Speak Channel

WC24 Errors

These errors are stored in /shared2/wc24/nwc24dl.bin to record the errors of each download content. These errors are also displayed on-screen when software using WC24 to immediately download content fails with a WC24 error. Errors in the 117xxx range seem to be HTTP error/status codes. These errors can be general wifi errors, with the same codes as displayed in Wifi software. Errors in the 1072xx range might be errors from KD_Download, where xx is the retval of KD_Download.

Error code Notes
107243 Invalid wc24dl.vff
107245 RSA signature verification failed. Or KD_CreateRSA failed.
117404 HTTP 404 Not Found
107304 HTTP 304 Not Modified