Changes

Nintendo Zone is the successor of DS Download Station, the latest revision in the Nintendo Spot series. The predecessor of Nintendo Zone in this series is DS Station, and the first revision in this series is Nintendo Spot. Although Nintendo Zone is the latest revision in the series, most game stores still use DS Station. This series downloads DS demos from an Internet server, rather than from a local DS host. Nintendo Zone locations have additional company-specific content. Companies can use this for information about the store/location, coupons with McDonalds, mini-games, etc.

Nintendo Zone is the successor of DS Download Station, the latest revision in the Nintendo Spot series. The predecessor of Nintendo Zone in this series is DS Station, and the first revision in this series is Nintendo Spot. Although Nintendo Zone is the latest revision in the series, most game stores still use DS Station. This series downloads DS demos from an Internet server, rather than from a local DS host. Nintendo Zone locations have additional company-specific content. Companies can use this for information about the store/location, coupons with McDonalds, mini-games, etc. Technical details available [http://code.google.com/p/wmb-asm/wiki/NintendoSpot here.]

Unlike DS Station, the Nintendo Zone client is rigged to only connect to an AP with a certain Broadcom tag. In other words, the client is rigged to only work with a certain router. When the AP has the correct SSID, WEP key, and Broadcom tag, the client attempts to connect to the AP.(WEP key is generated from the SSID, Nintendo software can automatically connect to these APs without any configuration.)

Unlike DS Station, the Nintendo Zone client is rigged to only connect to an AP with a certain Broadcom tag. In other words, the client is rigged to only work with a certain router. When the AP has the correct SSID, WEP key, and Broadcom tag, the client attempts to connect to the AP.(WEP key is generated from the SSID, Nintendo software can automatically connect to these APs without any configuration.)

When the DSi is in range of a Nintendo Zone AP, sysmenu will display a message that you're in range of a Nintendo Zone AP. The hidden DSi Nintendo Zone client will then appear in the [http://www.mcdonalds.co.jp/ds/how_to_play/ menu.] The client is basically a NetFront browser rigged to only work with certain APs, and with the capability of booting RSA-1024 signed NDS software. The client seems to only support Nintendo's custom NTFA file format for graphics.

When the DSi is in range of a Nintendo Zone AP, sysmenu will display a message that you're in range of a Nintendo Zone AP. The hidden DSi Nintendo Zone client will then appear in the [http://www.mcdonalds.co.jp/ds/how_to_play/ menu.] The client is basically a NetFront browser rigged to only work with certain APs, and with the capability of booting RSA-1024 signed NDS software downloaded with https. DS Station seems to only support Nintendo's custom [http://code.google.com/p/wmb-asm/wiki/NTFA NTFA] file format for graphics, it's currently unknown if Nintendo Zone supports other formats. Nintendo Spot supports other formats, one of the formats is GIF.

== Versions ==

== Versions ==

Version 3.0 of DSi Nintendo Zone client was released with the February 9, 2010 update. The Japanese client was updated to v3.0 on January 8, 2010. It is unknown what has changed.

Version 3.0 of the DSi Nintendo Zone client was released with the February 9, 2010 update. Version 3.0 of the Japanese client was released on January 8, 2010. It is unknown what has changed.

== Exploits ==

== Exploits ==

A DS Station exploit has been written by Yellows8. This DS Station exploit can't be adapted to Nintendo Zone until an Nintendo Zone AP capture and Nintendo Zone binary are obtained. A volunteer to capture Nintendo Zone AP traffic and the WMB binary was found a long while ago, but it is unknown when he'll capture. This exploit can only be used with html that is transferred over http. The html for the index main and sub screens is transferred over https. However, the html for the main screen for the pages after the index,(main server and third-party companies websites) is transferred with http. The sub screen html is transferred with https, with the main server. Sub screen html with third-party companies is transferred with http. Strangely, the back link from the menu after the index page for the main server, the main screen html URL uses http, rather than https.

A DS Station exploit has been written by Yellows8. This DS Station exploit can't be adapted to Nintendo Zone until an Nintendo Zone AP capture and Nintendo Zone binary are obtained. A volunteer to capture Nintendo Zone AP traffic and the WMB binary was found a long while ago, but it is unknown when he'll capture. This exploit can only be used with html that is transferred over http. The html for the index main and sub screens is transferred over https. However, the html for the main screen for the pages after the index,(main server and third-party companies websites) is transferred with http. The sub screen html is transferred with https, with the main server. Sub screen html with third-party companies is transferred with http. Strangely, the back link from the menu after the index page for the main server, the main screen html URL uses http, rather than https.

A means of bootstrapping homebrew is being worked on. Bootstrapping a .nds embedded in the exploit has been done somewhat successfully, but Arm7 code doesn't work 100%. Bootstrapping the Arm7 works fine when done with the embedded .nds. There seems to be zero issues with homebrew bootstrapped from a loader embedded in the exploit. When attempting to use touch screen in the embedded .nds, the Arm7 code doesn't work at all for touch screen. Most of the time, Arm7 Wifi doesn't work, it only worked once. Arm7 bootstrapping is buggy: adding only one instruction to either the arm9 or arm7 bootstubs cause a hang when the embedded .nds loader attempts to bootstrap the Arm7. NetFront limits the size of html files that can be downloaded. The max size of a LZSS compressed .nds embedded in the exploit is between 121.7KB - 129.9KB.

A means of bootstrapping homebrew is being worked on. Bootstrapping a .nds embedded in the exploit has been done somewhat successfully, but Arm7 code doesn't work 100%. Bootstrapping the Arm7 works fine when done with the embedded .nds. There seems to be zero issues with homebrew bootstrapped from a loader embedded in the exploit. When attempting to use touch screen in the embedded .nds, the Arm7 code doesn't work at all for touch screen. Most of the time, Arm7 Wifi doesn't work, it only worked once. Arm7 bootstrapping is buggy: adding only one instruction to either the arm9 or arm7 bootstubs cause a hang when the embedded .nds loader attempts to bootstrap the Arm7. When bootstrapping the Arm7 breaks with the embedded .nds loader, the Arm7 doesn't seem to be executing main() at all. Calling systemShutDown in Arm7 main doesn't shutdown the DS. NetFront limits the size of html files that can be downloaded. The max size of a LZSS compressed .nds embedded in the exploit is between 121.7KB - 129.9KB.