| This article may require cleanup to meet WiiBrew's quality standards.
Reason: Needs cleanup
- See also: WiiConnect24/WC24 Content
According to Nintendo,
"WiiConnect24 allows the console to receive downloads even when the console isn't in active use, as long as it has a working connection to the Internet."
However, this is an incomplete description, as it fails to explain why there exists a configuration option to enable WC24, but disable "Standby Connect".
WC24 is actually a codename for the /dev/kd driver in IOS that allows the Starlet core to perform network-related tasks when the main CPU (Broadway) is powered off. Only a small fractional of the full functionality of this software is being used -- generally to either download large chunks of data in the background or keep small amounts of data continuously updated (news, weather, friend data in games, etc.)
The kd driver is large -- about 360k -- and makes heavy use of the SSL, SO (socket) and WL / ETH (wireless / Ethernet) drivers; together, this functionality comprises about 75% of the firmware.
Static analysis reveals the following main categories of functionality:
- Sophisticated task scheduler, including periodic wakeup of either processor for maintenance tasks, and tracking max duty cycle ("Too much wakeup executed recently. Need to wait."), probably used for thermal management
- Mail engine, for sending and receiving email
- Real-time clock, with synchronization to a Nintendo-run server (over SSL). When KD syncs time with this server, it converts the date header from the server and sets it to the current UTC time. Time is synced sometimes when KD_Download is executed, it is unknown what triggers time sync from KD_Download exactly. If connecting to the time server fails, KD_Download will abort, return and write a error every time until the connection succeeds.
- This feature was never used by Nintendo: booting a title on NAND via sysmenu with the NANDBOOTINFO file attachment from certain mail, when in idle/"standby" mode.
- Logging / debug capability, e.g.
13DFA93C DCB "This report was sent from Wii to debug your scripts.",0xD,0xA 13DFA93C ; DATA XREF: NWC24WriteLogFile:off_13DB619C�o 13DFA93C DCB "The result summary is in the following:",0xD,0xA 13DFA93C DCB 0xD,0xA 13DFA93C DCB "- General information",0xD,0xA 13DFA93C DCB " WiiConnect24 result code : %d",0xD,0xA 13DFA93C DCB " Number of committed mail : %d",0xD,0xA 13DFA93C DCB " VF archive : %s",0xD,0xA 13DFA93C DCB 0xD,0xA 13DFA93C DCB "- Trigger mail information",0xD,0xA 13DFA93C DCB " Application ID : 0x%08x [%c%c%c%c]",0xD,0xA 13DFA93C DCB " Group ID : 0x%04x [%c%c]",0xD,0xA 13DFA93C DCB " Script parameter : 0x%02x",0xD,0xA 13DFA93C DCB " Time to live : %d",0xD,0xA 13DFA93C DCB " Number of attached file : %d",0xD,0xA 13DFA93C DCB 0xD,0xA 13DFA93C DCB "- Virtual machine specific information",0xD,0xA 13DFA93C DCB " Result code of the VM : %d [%s]",0xD,0xA 13DFA93C DCB " Return value of the script : 0x%016llx",0xD,0xA 13DFA93C DCB " Last PC : 0x%08x",0xD,0xA 13DFA93C DCB " Last line : %u",0xD,0xA 13DFA93C DCB " Initial free work size : %u",0xD,0xA 13DFA93C DCB " Minimum free work size : %u",0xD,0xA 13DFA93C DCB 0xD,0xA 13DFA93C DCB "For more information, please see the attached log file.",0xD,0xA
- Friend list management
The message board is a place where you can send and receive messages with other Wiis and email addresses. Games can also put messages here for accomplishments and the like. Channels can also send you updates and Nintendo can alert you when your firmware is ready to be updated. This is handled with the mail engine. Announcements from Nintendo and channels are downloaded with HTTP(S).
WC24 title booting
WC24 can boot titles specified in a NANDBOOTINFO E-Mail attachment. When a message is received with the correct headers, the NANDBOOTINFO attachment is written to NAND. The NANDBOOTINFO attachment is only written to NAND when the system is in idle/"standby" mode. This only works with WC24 HTTP(S) mail, not direct mail with the mail engine. WC24 title booting is normally disabled with the wakeup flag in /shared2/wc24/nwc24msg.cfg since that flag is normally zero. The next time STM_Wakeup is called, the sysmenu is booted to boot the specified title. When this is used with boot mail, STM_Wakeup is called immediately after KD_ProcessMail is executed when the boot mail was processed. Sysmenu doesn't create/init playrec.dat for title play stats with WC24 title booting. When in idle mode, KD deletes the mail from wc24recv.mbx before calling STM_Wakeup for boot mail. If the system is "on" when boot mail is processed, the NANDBOOTINFO won't be written to NAND but the mail won't be deleted. KD will keep trying to process the mail until in idle mode. Before sysmenu boots a title, it modifies NANDBOOTINFO so that it doesn't boot the same title again on next sysmenu boot. When sysmenu modifies NANDBOOTINFO before booting the tiles, it changes NANDBOOTINFO.apptype to 0x40, NANDBOOTINFO.titletype to 0x02, and the normally zero u32 between the argv offsets and the actual arguments is set to 0xFFFFFFFF. NANDBOOTINFO.titletype must be 8, and the argbuf is processed in some unclear way. The title to boot is specified the same way as regular sysmenu title booting, where argv is the titleID in ASCII hex. If a title is specified that doesn't exist on NAND, sysmenu modifies NANDBOOTINFO as described above and shuts down. WC24 title booting can't be used to launch discs, only titles on NAND.
The next STM_Wakeup call timestamp is stored in /shared2/wc24/misc.bin. When boot mail is received, KD increases a timestamp stored in misc.bin by 24-hours in seconds. When KD_Download and KD_CheckMail are run in the background, this timestamp is compared the current UTC time. When boot mail was never used before this timestamp is zero. This seems to be reset to zero by sysmenu when title booting is used, however it's unknown what it checks for when clearing this. Wc24app from libwc24 SVN can install a boot mail entry, direct link here. That wc24testboot mail uses this NANDBOOTINFO attachment, this would boot HBC. The mail content for the entry that wc24app can install has the first field in the X-Wii-AppID header set to 1, so that sysmenu ignores the mail, so it doesn't break the boot mail by moving it to cdb.vff. The value of the X-Wii-Cmd must have bit 17(0x20000) set, and (value & 0x00ffffff) - 0x20001 must be <=1. Below is example headers needed to trigger writing the attachment to NANDBOOTINFO:
X-Wii-Cmd: 00020002 X-Wii-AppID: 1-AF1BF516-4842
Nintendo currently can't auto-update Wiis. They could auto-update with WC24 title booting if they would add code to sysmenu. WC24 title booting is normally disabled, if Nintendo would ever want to auto-update Wiis they would need to add code to sysmenu to enable WC24 title booting. This is normally disabled with sysmenu 4.1 and below, it's extremely unlikely that it was enabled in 4.2/4.3. Like direct sysmenu loading with this argument, when WC24 title booting is used with a NANDBOOTINFO with launchcode set to 1, argv set to 1-2, argv set to the page in this case "Update/Update_index.html", when sysmenu is booted via WC24 title booting sysmenu would boot itself, then sysmenu would load the system update confirmation screen.(Like accessing this normally, sysmenu will ask for the PIN if parental controls are enabled.) Currently sysmenu will display the screen asking to confirm if you want to update, before updating. This NANDBOOTINFO with WC24 title booting was only tested with sysmenu 3.4, but it's extremely unlikely that any of this WC24 and system update sysmenu code changed in 4.x sysmenus.
These Wii mail headers make the msg board or WC24 enable various GUI features and WC24 tasks. These headers can only be used with mail downloaded with WC24 via HTTP, not directly with E-Mail from a computer. X-Wii-MB headers for message board are disabled for mail received from computers via E-Mail. WC24 title booting mail can't be sent directly from an E-Mail address, KD ignores the X-Wii-Cmd and X-Wii-AppID headers.
|X-Wii-AltName||AE4AaQBuAHQAZQBuAGQAbw==||When used, the decoded Base64 UTF-16 is used for the sender name on the msg board.(The example value decodes to UTF-16 "Nintendo"(with zeroes from English UTF-16 removed), without the quotes.)|
|X-Wii-MB-NoReply||1||Hides the reply button on the msg board.|
|X-Wii-MB-UpdateSW||1||Enables the "Update" msg board button, which launches the system update from the sysmenu options.|
|X-Wii-MB-OptOut||1||Enables the "Opt Out" msg board button, which probably deletes all nwc24dl.bin entries and records for the title specified by X-Wii-AppID with type WC24_TYPE_MSGBOARD.|
|X-Wii-IconNew||524D4345||Enables the "Start" msg board button, which boots the title specified by this header value?|
|X-WiiFace||This is a base64 encoded Mii. After the 56th base64 ASCII character, the rest of the data is split off into a newline with a space before the data.|
|X-Wii-AppID||3-48414541-3031||First field is parameter of some sort, middle field is titleid low, last field is title group id. Sysmenu ignores the mail when the first field is 1. Normally type 1(first field) is used for games mail sent between Wiis so that the games can manually process the mail directly without CHANS. This type is also used with the boot mail content entry installable by wc24app, so that sysmenu doesn't interfere and break WC24 title booting by moving the mail to cdb.vff.|
|X-Wii-Cmd||00048001||Some cmd header that basically determines what to do this this mail. This can be 00048001 for msg board mail. Other values like 00042019 mean this mail can be processed by CHANS, the title script to use is specified by X-Wii-AppId.|
|X-Wii-Tag||00001000||Probably some kind of CHANS parameter?|
|X-Wii-Download-Interval||?||Sets the mail entry dl_freq_perday field to the value of this header, see this for the range in the section for the entry flags: /shared2/wc24/nwc24dl.bin It's unknown if this value must be hex or decimal.|
The CHANS onrecv.kwb script stored in the title's wc24scr.vff under the data directory is used for processing certain mail, which have the X-Wii-Cmd header value set to 00042019. There can also be "public" mail: "public" mail is processed by the onrecvpm.kwb CHANS script in the title's wc24scr.vff. It's unknown what header value makes mail "public". "Normal" mail appears on the msg board, "public" mail doesn't appear on the msg board. For a list of functions used by CHANS, see the CHANS_Reference page. The file storage.bin in wc24scr.vff contains the mail attachment, but CHANS scripts can write to storage.bin as well as read it. The banner scripts used by sysmenu are stored under the same U8 as the other banner files, with filenames banner.cs and icon.cs.
Wii games using WC24:
- Animal Crossing: City Folk
- Big Brain Academy: Wii Degree
- Blast Works: Build, Trade, Destroy
- Boom Blox
- Dewy's Adventure
- Jissen Pachi-Slot Pachinko Hisshôhô! Hokuto no Ken Wii
- Mario Kart Wii
- Marble Saga: Kororinpa
- Metroid Prime 3: Corruption
- Metroid Prime Trilogy
- Pro Evolution Soccer 2008
- Super Smash Bros. Brawl
- SimCity Creator
- Wii Music
WiiWare games using WC24:
- Dr. Mario Online Rx
- MaBoShi: The Three Shape Arcade
- My Aquarium
- My Pokémon Ranch
- Strong Bad's Cool Game for Attractive People - Episode 1: Homestar Ruiner
- Strong Bad's Cool Game for Attractive People - Episode 2: Strong Badia the Free
Channels using WC24:
- Mii Channel
- Forecast Channel
- News Channel
- Wii Shop Channel
- Everybody Votes Channel
- Check Mii Out Channel
- Mario Kart Wii Channel
- Nintendo Channel
- Wii Speak Channel
These errors are stored in /shared2/wc24/nwc24dl.bin to record the errors of each download content. These errors are also displayed on-screen when software using WC24 to immediately download content fails with a WC24 error. Errors in the 117xxx range seem to be HTTP error/status codes. These errors can be general wifi errors, with the same codes as displayed in Wifi software. Errors in the 1072xx range might be errors from KD_Download, where xx is the retval of KD_Download.
|107216||The VFF subdirectories which the file path is under doesn't exist.|
|107245||RSA signature verification failed. Or KD_CreateRSA failed.|
|117404||HTTP 404 Not Found|
|107304||HTTP 304 Not Modified|