This is a follow-up to my previous article. Much of the interesting traffic from the previous post was SSL encrypted. The easiest thing to get around that in your own setup is using Dug Song’s dsniff package. The problem is that the Wii does not send an HTTP V1.1 virtual host command, so you will have to hack webmitm.c to specify your own hosts. For best results, point all of the Nintendo sites to individual IPs on your private network and run several webmitm binaries to bind to each IP address. You can get the full transfers from there. If you are a clever person, you can code your own meta file (including hashes for all four parts of the binary) and use your own content.bin to create a new channel. Given all this information, why bother. Just buy the game, its less than or equal to the cost of a few pints at the bar.

(Next time you see a video proving to do all this, watch for the actual game play.)

So I decided to look at what the Wii actually does with it’s wireless capabilities. I connected a Linksys WAP54G access point to the ethernet port of my FreeBSD-equipped laptop and enabled both DNS lookups and network address translation. Essentially, the laptop connects the wireless network that the Wii is on with the wireless network that is connected to the internet and is able to capture all of the packets with Ethereal/Wireshark. Upon looking over the first set of dumps briefly, I noticed that most of the shop channel communications are done over SSL (good!) and that Wii seems to have IPv6 capability as it requests both A and AAAA records for hostnames. Once I analyze the dumps further, I will look at cooler experiments to do with this setup. Any requests for more specific network dumps can be made by commenting. So far, I have the connection test, update check, browsing the web with opera, and various activities on the shop channel captured. For now, I will try to investigate the messaging system and look at what actual communications happen when the system is in standby mode. Updates should appear later this week.

( wii-dumps.zip ) ( dumps are in pcap format and can be viewed with Ethereal, Wireshark, or almost any other packet capture program )

“An input device providing users with a pointing capability includes a sender portion and a receiver portion. The sender portion is adapted to be manipulated by a user to specify a target point within a target area. The sender portion projects a light beam including a pattern on to the target area. A receiver portion includes one or more sensor units located in or near the target area. At least some of the sensor units receive a portion of the light beam regardless of the location of the target point within the target area. A processing unit in the receiver portion analyzes the portions of the light beam received by one or more sensor units to determine an attribute of the target point. The attribute can be the location or relative motion of the target point. The receiver portion may be integrated with a display device.”

( source )