Changes

Nintendo Zone is the successor of DS Download Station, the latest revision in the Nintendo Spot series. The predecessor of Nintendo Zone in this series is DS Station, and the first revision in this series is Nintendo Spot. Although Nintendo Zone is the latest revision in the series, most game stores still use DS Station. This series downloads DS demos from an Internet server, rather than from a local DS host. Technical info on NSpot/DS Station is available [http://code.google.com/p/wmb-asm/wiki/NintendoSpot here.] Nintendo Zone locations have additional company-specific content. Companies can use this for information about the store/location, coupons with JP McDonalds won by quizzes, prizes, mini-games, etc.

Nintendo Zone is the successor of DS Download Station, the latest revision in the Nintendo Spot series. The predecessor of Nintendo Zone in this series is DS Station, and the first revision in this series is Nintendo Spot. Although Nintendo Zone is the latest revision in the series, most game stores still use DS Station, however JP stores are starting to switch to NZone. This series downloads DS demos from an Internet server, rather than from a local DS host. Technical info on NSpot/DS Station is available [http://code.google.com/p/wmb-asm/wiki/NintendoSpot here.] Nintendo Zone locations have additional company-specific content. Companies can use this for information about the store/location, coupons with JP McDonalds won by quizzes, prizes, mini-games, etc.

Nintendo Zone is available in Japan. Nintendo World Store in New York City used to have NZone, but they don't have NZone or even DS Download Station anymore. A few McDonalds test locations in [http://translate.google.com/translate?langpair=de|en&u=http%3A%2F%2Fnintendo.de%2FNOE%2Fde_DE%2Fnews%2Fevents%2Fpilotprojekt_-_nintendo_zone_bei_mcdonalds_18254.html Germany] used to have NZone. That test service ended, the EUR NZone server was completely shutdown on Aug 27th 2010. Several USA Best Buy locations started a NZone test service in June 2009, see [http://gonintendo.com/viewstory.php?id=84077 this]. That test service ended, NZone is non-existent in USA since no test services exist in USA. NZone pictures [http://gonintendo.com/viewstory.php?id=84247 here]. EUR NZone screenshots [http://translate.google.com/translate?langpair=de|en&u=http%3A%2F%2Fwww.bisafans.de%2Flexikon%2F069.shtml here] and [http://translate.google.com/translate?langpair=de|en&u=http%3A%2F%2Fwww.filb.de%2F1376 here]. Old USA NYC screenshots [http://www.nintendo.com/bin/w3I-XYyMEgk1VUUqyo5k-P4eQc_mlXDU/mcHH5cHLGbg5AJQIa_x2nLkBLEUlFmEJ.pdf here.]

Nintendo Zone is available in Japan. Nintendo World Store in New York City used to have NZone, but they don't have NZone or even DS Download Station anymore. A few McDonalds test locations in [http://translate.google.com/translate?langpair=de|en&u=http%3A%2F%2Fnintendo.de%2FNOE%2Fde_DE%2Fnews%2Fevents%2Fpilotprojekt_-_nintendo_zone_bei_mcdonalds_18254.html Germany] used to have NZone. That test service ended, but the EUR server is still online. Several USA Best Buy locations started a NZone test service in June 2009, see [http://gonintendo.com/viewstory.php?id=84077 this]. That test service ended, NZone is non-existent in USA since no test services exist in USA. NZone pictures [http://gonintendo.com/viewstory.php?id=84247 here]. EUR NZone screenshots [http://translate.google.com/translate?langpair=de|en&u=http%3A%2F%2Fwww.bisafans.de%2Flexikon%2F069.shtml here] and [http://translate.google.com/translate?langpair=de|en&u=http%3A%2F%2Fwww.filb.de%2F1376 here]. Old USA NYC screenshots [http://www.nintendo.com/bin/w3I-XYyMEgk1VUUqyo5k-P4eQc_mlXDU/mcHH5cHLGbg5AJQIa_x2nLkBLEUlFmEJ.pdf here.] Japan screenshots: [http://translate.google.com/translate?langpair=ja|en&u=http%3A%2F%2Fwww.nintendo.co.jp%2Fds%2Fnintendozone%2Fhowto_dsi.html here] and [http://translate.google.com/translate?langpair=ja|en&u=http%3A%2F%2Fwww.driveplaza.com%2Fds%2Fhowto.html here].

 

[[File:2010-08-08-203240.jpg|200px|thumb|right|Sysmenu displays this when NZone is detected for the first time.]]

[[File:2010-08-08-203240.jpg|200px|thumb|right|Sysmenu displays this when NZone is detected for the first time.]]

== Client usage ==

== Client usage ==

Unlike DS Station, the Nintendo Zone client is rigged to only connect to a certain AP when there's a special beacon with the payload encrypted in range. The payload uses a checksum, modifying any of the payload causes sysmenu/NZone to not detect the beacons/NZone. When the AP has the correct SSID and WEP key(WEP isn't always used), the client attempts to connect to the AP. The AP SSID and WEP key if any is contained in the special beacon in the encrypted payload.

Unlike DS Station, the Nintendo Zone client is rigged to only connect to a certain AP when there's a special beacon with the payload encrypted in range. When the AP has the correct SSID and WEP key(WEP isn't always used), the client attempts to connect to the AP. The AP SSID and WEP key if any is contained in the special beacon in the encrypted payload.

When the DSi is in range of the special beacon with the encrypted payload for the first time, sysmenu will display a message that you're in range of a Nintendo Zone. When you press the "Start" button, sysmenu boots NZone. The hidden DSi Nintendo Zone client will then appear in the [http://www.mcdonalds.co.jp/ds/how_to_play/ menu,] see the images to the right as well. After the initial NZone detection, the client icon always stays in the menu, it is never removed. When NZone is detected the second time in sysmenu, the icon and the icon on the strip which you can touch with stylus to select app icons starts flashing, and a sound constantly plays while in range of NZone. If sysmenu doesn't detect another NZone beacon for 10 seconds, the flashing and sound stops. The region is somehow determined by the special beacon, NZone is not region-locked. The client uses the correct URLs for the region somehow specified by the special beacon. Initially the client normally seems to use hard-coded URLs, but when it somehow detects "invalid" URLs or a perhaps a failed request the client seems to use URLs from the encrypted beacon payload.

When the DSi is in range of the special beacon with the encrypted payload for the first time, sysmenu will display a message that you're in range of a Nintendo Zone. When you press the "Start" button, sysmenu boots NZone. The hidden DSi Nintendo Zone client will then appear in the [http://www.mcdonalds.co.jp/ds/how_to_play/ menu,] see the images to the right as well. After the initial NZone detection, the client icon always stays in the menu, it is never removed. When NZone is detected the second time in sysmenu, the icon and the icon on the strip which you can touch with stylus to select app icons starts flashing, and a sound constantly plays while in range of NZone. If sysmenu doesn't detect another NZone beacon for 10 seconds, the flashing and sound stops. NZone is not region-locked, the server region is determined by the special beacon.

The NZone beacon code is contained in TWL SDK. DSi opera web browser automatically connects to NZone APs, all official DSi software automatically connects to NZone APs. NZone has a option to install a wifi config entry for the NZone AP, for old NTR SDK games run from cards.

The client is basically a NetFront browser rigged to only work with certain APs, and with the capability of booting RSA-1024 signed NDS software downloaded with https. DS Station seems to only support Nintendo's custom [http://code.google.com/p/wmb-asm/wiki/NTFA NTFA] file format for graphics. Nintendo Spot supports other formats, one of the formats is GIF. Nintendo Zone supports NTFA, GIF, and PNG.

The client is basically a NetFront browser rigged to only work with certain APs, and with the capability of booting RSA-1024 signed(same as WMB sign system) NDS software downloaded with https. DS Station seems to only support Nintendo's custom [http://code.google.com/p/wmb-asm/wiki/NTFA NTFA] file format for graphics. Nintendo Spot supports other formats, one of the formats is GIF. Nintendo Zone supports NTFA, GIF, and PNG.

The DSi NZone with the memo menu, can take pictures with the DSi cameras and save to the camera album. You can also draw stuff then save to camera album, and take screenshots of either screen at anytime(except when loading pages, sometimes memo menu is disabled by third-party sites) and save to NZone savedata. Screenshots can be viewed later via the memo menu, regardless if NZone beacons are in range or not. The NZone WFC usage notes state: "Photos, drawings or any other kind of images that you post via the Nintendo Zone can be viewed and downloaded by other users, and may be made public via Nintendo Zone or the internet. These photos, drawings or other kinds of image may then be copied, edited and/or posted by others." The rest is just "your images may be seen by a large number of people, don't post offensive material or copyrighted etc."

The DSi NZone with the memo menu, can take pictures with the DSi cameras and save to the camera album. You can also draw stuff then save to camera album, and take screenshots of either screen at anytime(except when loading pages, sometimes memo menu is disabled by third-party sites) and save to NZone savedata. Screenshots can be viewed later via the memo menu, regardless if NZone beacons are in range or not. The NZone WFC usage notes state: "Photos, drawings or any other kind of images that you post via the Nintendo Zone can be viewed and downloaded by other users, and may be made public via Nintendo Zone or the internet. These photos, drawings or other kinds of image may then be copied, edited and/or posted by others." The rest is just "your images may be seen by a large number of people, don't post offensive material or copyrighted etc."

=== Beacon payload format ===

=== Beacon payload format ===

The NZone beacon payload is encrypted, the cipher and key is unknown. This table is the format of the cleartext data, this was dumped by hooking the Arm9 IPX function. The crypto is done Arm7-side.

The NZone beacon payload is encrypted with an XOR pad. It's not the trivial sequential XOR code. The XOR pad is generated from a 8-byte key: the first 4-bytes is "!SDW",(might be a reference to [http://en.wikipedia.org/wiki/Wireless_Distribution_System WDS]?) the last 4 bytes are the last 4 bytes of the beacon BSSID MAC. Nintendo Spot uses the same special beacon encryption, the cleartext differs from NZone slightly for the unknown fields.

TWL SDK probably scans for beacons, checks if beacon_type is 0 or 1, and checks if the payload length is 0x70. If those succeed, it then decrypts the whole payload and verifies the checksum. When the checksum is valid, NZone is detected.

This table is the format of the cleartext data.

The NZone beacon code is contained in TWL SDK, arm9 side. DSi opera web browser automatically connects to NZone APs, all official DSi software automatically connects to NZone APs. NZone has a option to install a wifi config entry for the NZone AP, for old NTR SDK games run from cards.

TWL SDK scans for beacons with the Nintendo tag(0xDD) with payload size 0x70. When those are found, it decrypts them and verifies the checksum, when that's valid NZone is detected.

{| class="wikitable" border="1"

{| class="wikitable" border="1"

| 0x20

| 0x20

| 10

| 10

| Authentication parameter, required for connecting to the server. Server uses this to determine which third-party content to link to on the index page.

| Authentication parameter, required for connecting to the server. Server uses this to determine which third-party content to link to on the index page. First ASCII number char in this param is region, this is also used to determine which server to connect to. Regions: 0) JP 1) USA 2/3) EUR 4) KOR 5) China

|-

|-

| 0x2a

| 0x2a

| 2

| 2

| This u16 was always one in all dumps, unknown what this is.

| This u16 was always one in all dumps, unknown what this is. This isn't used by the client.

|-

|-

| 0x2c

| 0x2c

| 24

| 24

| Some retailer ID string includes the country, unknown what this is. "McDonalds Japan"

| Some retailer ID string includes the country, unknown what this is but it's not used by the client. "McDonalds Japan"

|-

|-

| 0x44

| 0x44

|-

|-

| 0x64

| 0x64

| 4

| 1

| Unknown, region related maybe?

| Unknown, not used by the client.

|-

|-

| 0x68

| 0x67

| 4

| 5

| Padding?

| Padding.

|-

|-

| 0x6c

| 0x6c

| 2

| 2

| Unknown, was always 0x428 in all dumps.

| Unknown, was always 0x428 in all dumps. Not used by the client.

|-

|-

| 0x6e

| 0x6e

| 2

| 2

| CRC16 over whole payload.

| CRC16 over the whole payload excluding checksum offset, initval is 0.

|}

|}

DS Station's web browser uses NetFront 3.3.

DS Station's web browser uses NetFront 3.3.

Nintendo Zone v3.0 has the URL buffer overflow bug from NetFront 3.3 and DS Station. The NetFront version user agent was removed from the NZone bin, so it's unknown what NetFront version NZone uses. Linux/hostapd compatible box and a NIC supported by hostapd is required.

Nintendo Zone v3.0 has the URL buffer overflow bug from NetFront 3.3 and DS Station, but htmlhaxx is [[#Security|impossible]] to use with NZone due to SSL. The NetFront version user agent was removed from the NZone bin, so it's unknown what NetFront version NZone uses.

A DS Station/NZone exploit has been written by [[User:Yellows8|Yellows8]]. The exploit is only available on Google Code wmb-asm SVN. SVN web interface is available [http://code.google.com/p/wmb-asm/source/browse/#svn/trunk/ds/nzonehtmlhaxx here], SVN URL available [http://wmb-asm.googlecode.com/svn/trunk/ds/nzonehtmlhaxx here.] To use the exploit at home with DS Station, you also need a HTTPS forwarder/proxy, like httpsforwarder available in SVN. This exploit can only be used with html that is transferred over http. All html on the NZone server was moved to HTTPS. Although the NZone bin has root CAs for VeriSign, Thawte, Nintendo, and others, NZone rejects all certs not signed by Nintendo which includes VeriSign, Thawte, etc. The html for the index main and sub screens is transferred over https. However, the html for the main screen for the pages after the index,(main server for DS Station only) is transferred with http. The sub screen html is transferred with https, with the main server.

A DS Station exploit was written by [[User:Yellows8|Yellows8]]. The exploit is only available on Google Code wmb-asm SVN. SVN web interface is available [http://code.google.com/p/wmb-asm/source/browse/#svn/trunk/ds/nzonehtmlhaxx here], SVN URL available [http://wmb-asm.googlecode.com/svn/trunk/ds/nzonehtmlhaxx here.] To use the exploit at home with DS Station, you need a Linux/hostapd compatible box and a NIC supported by hostapd. You also need a HTTPS forwarder/proxy, like httpsforwarder available in SVN. This exploit can only be used with html that is transferred over http.

This DS Station exploit works perfectly on DSi with WMB ds-mode. The default embedded .nds in the exploit loads hbmenu from flash card, loading from flash card works perfectly on DSi in WMB ds-mode from DS Station nzonehtmlhaxx.

You need the DS Station bin to use this exploit, but the bin will not be publicly redistributed due to copyright etc.

[[File:2010-08-22-161844.jpg|200px|thumb|right|Test NZone haxx, crashed NZone. The EUR server bug exploited here was fixed a couple hours after beginning html injection attacks.]]

[[File:2010-08-22-161844.jpg|200px|thumb|right|Test NZone haxx, crashed NZone. The EUR server bug exploited here was fixed a couple hours after beginning html injection attacks.]]

The EUR NZone server used to have the [http://www.phonefactor.com/sslgap SSL] [http://extendedsubset.com/?p=8 renegotiation] [http://www.g-sec.lu/tls-ssl-proof-of-concept.html authentication] [http://www.educatedguesswork.org/2009/11/understanding_the_tls_renegoti.html gap] bug. Initially, exploiting this with the redirection script on the server were being attempted. Then on the next day, attacks via HTTP TRACE requests to inject html into the server response to the DSi NZone client were done. Tests of crashing DSi NZone with nzonehtmlhaxx was done twice: first test was injecting htmlhaxx when the client tried sending a request to the redirection script for third-party content, the second test was injecting htmlhaxx immediately when the client first connected to the server. Both tests crashed DSi NZone perfectly. HTTP TRACE is never used by NZone or any web browser. Counting from the initial attack, Nintendo fixed this in less than 26 hours. Counting from when attacks with HTTP TRACE were started, Nintendo fixed this in less than 4 hours. The picture to the right is a shot of crashed DSi NZone, Nintendo fixed the bug before any payload was executed.

The EUR NZone server used to have the [http://www.phonefactor.com/sslgap SSL] [http://extendedsubset.com/?p=8 renegotiation] [http://www.g-sec.lu/tls-ssl-proof-of-concept.html authentication] [http://www.educatedguesswork.org/2009/11/understanding_the_tls_renegoti.html gap] bug. Initially, exploiting this with the redirection script on the server were being attempted. Then on the next day, attacks via HTTP TRACE requests to inject html into the server response to the DSi NZone client were done. Tests of crashing DSi NZone with nzonehtmlhaxx was done twice: first test was injecting htmlhaxx when the client tried sending a request to the redirection script for third-party content, the second test was injecting htmlhaxx immediately when the client first connected to the server. Both tests crashed DSi NZone perfectly. HTTP TRACE is never used by NZone or any web browser. Counting from the initial attack, Nintendo fixed this in less than 26 hours. Counting from when attacks with HTTP TRACE were started, Nintendo fixed this in less than 4 hours. The picture to the right is a shot of crashed DSi NZone, Nintendo fixed the bug before any payload was executed.