def get_server_info_alt(self, gameid, session_id, client_id): console = False ipstr = self.session_list[session_id][client_id]['addr'][0] ip = str(utils.get_ip( bytearray([int(x) for x in ipstr.split('.')]), 0, console )) console = not console serveraddr = self.server_manager.find_server_by_local_address( ip, self.session_list[session_id][client_id]['localaddr'], self.session_list[session_id][client_id]['gameid'] )._getvalue() if serveraddr is None: ip = str(utils.get_ip( bytearray([int(x) for x in ipstr.split('.')]), 0, console )) serveraddr = self.server_manager.find_server_by_local_address( ip, self.session_list[session_id][client_id]['localaddr'], self.session_list[session_id][client_id]['gameid'] )._getvalue() return serveraddr
def get_server_info(self, gameid, session_id, client_id): server_info = None servers = self.server_manager.get_natneg_server(session_id)._getvalue() if servers == None: return None console = False ipstr = self.session_list[session_id][client_id]['addr'][0] ip = str( utils.get_ip(bytearray([int(x) for x in ipstr.split('.')]), 0, console)) console = not console server_info = next((s for s in servers if s['publicip'] == ip), None) if server_info == None: ip = str( utils.get_ip(bytearray([int(x) for x in ipstr.split('.')]), 0, console)) server_info = next((s for s in servers if s['publicip'] == ip), None) return server_info
def get_server_info(self, gameid, session_id, client_id): server_info = None servers = self.server_manager.get_natneg_server(session_id) \ ._getvalue() if servers is None: return None console = False ipstr = self.session_list[session_id][client_id]['addr'][0] ip = str(utils.get_ip(bytearray( [int(x) for x in ipstr.split('.')] ), 0, console)) console = not console server_info = next((s for s in servers if s['publicip'] == ip), None) if server_info is None: ip = str(utils.get_ip( bytearray([int(x) for x in ipstr.split('.')]), 0, console )) server_info = next( (s for s in servers if s['publicip'] == ip), None ) return server_info
def find_server_in_cache(self, addr, port, console): ip = str( utils.get_ip(bytearray([int(x) for x in addr.split('.')]), 0, console)) server = self.server_manager.find_server_by_address(ip, port)._getvalue() self.log(logging.DEBUG, "find_server_in_cache is returning: %s %s", server, ip) return server, ip
def find_server_in_cache(self, addr, port, console): ip = str(utils.get_ip( bytearray([int(x) for x in addr.split('.')]), 0, console )) server = self.server_manager.find_server_by_address(ip, port)._getvalue() self.log(logging.DEBUG, "find_server_in_cache is returning: %s %s", server, ip) return server, ip
def get_server_info_alt(self, gameid, session_id, client_id): console = False ipstr = self.session_list[session_id][client_id]['addr'][0] ip = str( utils.get_ip(bytearray([int(x) for x in ipstr.split('.')]), 0, console)) console = not console serveraddr = self.server_manager.find_server_by_local_address( ip, self.session_list[session_id][client_id]['localaddr'], self.session_list[session_id][client_id]['gameid'])._getvalue() if serveraddr == None: ip = str( utils.get_ip(bytearray([int(x) for x in ipstr.split('.')]), 0, console)) serveraddr = self.server_manager.find_server_by_local_address( ip, self.session_list[session_id][client_id]['localaddr'], self.session_list[session_id][client_id] ['gameid'])._getvalue() return serveraddr
def rawDataReceived(self, data): try: # First 2 bytes are the packet size. # # Third byte is the command byte. # According to Openspy-Core: # 0x00 - Server list request # 0x01 - Server info request # 0x02 - Send message request # 0x03 - Keep alive reply # 0x04 - Map loop request (?) # 0x05 - Player search request # # For Tetris DS, at the very least 0x00 and 0x02 need to be # implemented. self.buffer += data while len(self.buffer) > 0: packet_len = utils.get_short(self.buffer, 0, True) packet = None if len(self.buffer) >= packet_len: packet = self.buffer[:packet_len] self.buffer = self.buffer[packet_len:] if packet is None: # Don't have enough for the entire packet, break. break if packet[2] == '\x00': # Server list request self.log(logging.DEBUG, "Received server list request from %s:%s...", self.address.host, self.address.port) # This code is so... not python. The C programmer in me is # coming out strong. # TODO: Rewrite this section later? idx = 3 list_version = ord(packet[idx]) idx += 1 encoding_version = ord(packet[idx]) idx += 1 game_version = utils.get_int(packet, idx) idx += 4 query_game = utils.get_string(packet, idx) idx += len(query_game) + 1 game_name = utils.get_string(packet, idx) idx += len(game_name) + 1 challenge = ''.join(packet[idx:idx + 8]) idx += 8 filter = utils.get_string(packet, idx) idx += len(filter) + 1 fields = utils.get_string(packet, idx) idx += len(fields) + 1 options = utils.get_int(packet, idx, True) idx += 4 source_ip = 0 max_servers = 0 NO_SERVER_LIST = 0x02 ALTERNATE_SOURCE_IP = 0x08 LIMIT_RESULT_COUNT = 0x80 send_ip = False if (options & LIMIT_RESULT_COUNT): max_servers = utils.get_int(packet, idx) elif (options & ALTERNATE_SOURCE_IP): source_ip = utils.get_ip(packet, idx) elif (options & NO_SERVER_LIST): send_ip = True if '\\' in fields: fields = [ x for x in fields.split('\\') if x and not x.isspace() ] # print "%02x %02x %08x" % \ # (list_version, encoding_version, game_version) # print "%s" % query_game # print "%s" % game_name # print "%s" % challenge # print "%s" % filter # print "%s" % fields # print "%08x" % options # print "%d %08x" % (max_servers, source_ip) self.log( logging.DEBUG, "list version: %02x / encoding version: %02x /" " game version: %08x / query game: %s /" " game name: %s / challenge: %s / filter: %s /" " fields: %s / options: %08x / max servers: %d /" " source ip: %08x" % (list_version, encoding_version, game_version, query_game, game_name, challenge, filter, fields, options, max_servers, source_ip)) # Requesting ip and port of client, not server if not filter and not fields or send_ip: output = bytearray( [int(x) for x in self.address.host.split('.')]) # Does this ever change? output += utils.get_bytes_from_short(6500, True) enc = gs_utils.EncTypeX() output_enc = enc.encrypt( self.secret_key_list[game_name], challenge, output) self.transport.write(bytes(output_enc)) self.log(logging.DEBUG, "%s", "Responding with own IP and game port...") self.log(logging.DEBUG, "%s", utils.pretty_print_hex(output)) else: self.find_server(query_game, filter, fields, max_servers, game_name, challenge) elif packet[2] == '\x02': # Send message request packet_len = utils.get_short(packet, 0, True) dest_addr = '.'.join(["%d" % ord(x) for x in packet[3:7]]) # What's the pythonic way to do this? unpack? dest_port = utils.get_short(packet, 7, True) dest = (dest_addr, dest_port) self.log( logging.DEBUG, "Received send message request from %s:%s to" " %s:%d... expecting %d byte packet.", self.address.host, self.address.port, dest_addr, dest_port, packet_len) self.log(logging.DEBUG, "%s", utils.pretty_print_hex(bytearray(packet))) if packet_len == len(packet): # Contains entire packet, send immediately. self.forward_data_to_client(packet[9:], dest) else: self.log(logging.ERROR, "%s", "ERROR: Could not find entire packet.") elif packet[2] == '\x03': # Keep alive reply self.log(logging.DEBUG, "Received keep alive from %s:%s...", (self.address.host, self.address.port)) else: self.log(logging.DEBUG, "Received unknown command (%02x) from %s:%s...", ord(packet[2]), self.address.host, self.address.port) self.log(logging.DEBUG, "%s", utils.pretty_print_hex(bytearray(packet))) except: self.log(logging.ERROR, "Unknown exception: %s", traceback.format_exc())
def handle_packet(self, recv_data, addr): """Handle NATNEG. TODO: Pointer to methods for recv_data[7].""" logger.log(logging.DEBUG, "Connection from %s:%d...", addr[0], addr[1]) logger.log(logging.DEBUG, utils.pretty_print_hex(recv_data)) # Make sure it's a legal packet if recv_data[0:6] != bytearray([0xfd, 0xfc, 0x1e, 0x66, 0x6a, 0xb2]): return session_id = struct.unpack("<I", recv_data[8:12])[0] session_id_raw = recv_data[8:12] # Handle commands if recv_data[7] == '\x00': logger.log(logging.DEBUG, "Received initialization from %s:%s...", addr[0], addr[1]) output = bytearray(recv_data[0:14]) # Checked with Tetris DS, Mario Kart DS, and Metroid Prime # Hunters, and this seems to be the standard response to 0x00 output += bytearray([0xff, 0xff, 0x6d, 0x16, 0xb5, 0x7d, 0xea]) output[7] = 0x01 # Initialization response self.write_queue.put((output, addr)) # Try to connect to the server gameid = utils.get_string(recv_data, 0x15) client_id = "%02x" % ord(recv_data[13]) localip_raw = recv_data[15:19] localip_int_le = utils.get_ip(recv_data, 15) localip_int_be = utils.get_ip(recv_data, 15, True) localip = '.'.join(["%d" % ord(x) for x in localip_raw]) localport_raw = recv_data[19:21] localport = utils.get_short(localport_raw, 0, True) localaddr = (localip, localport, localip_int_le, localip_int_be) self.session_list \ .setdefault(session_id, {}) \ .setdefault(client_id, { 'connected': False, 'addr': '', 'localaddr': None, 'serveraddr': None, 'gameid': None }) # In fact, it's a pointer (cf. shallow copy) client_id_session = self.session_list[session_id][client_id] client_id_session['gameid'] = gameid client_id_session['addr'] = addr client_id_session['localaddr'] = localaddr clients = len(self.session_list[session_id]) # Unused? for client in self.session_list[session_id]: # Another shallow copy client_session = self.session_list[session_id][client] if client_session['connected'] or client == client_id: continue # if client_session['serveraddr'] \ # is None: serveraddr = self.get_server_info(gameid, session_id, client) if serveraddr is None: serveraddr = self.get_server_info_alt( gameid, session_id, client ) client_session['serveraddr'] = serveraddr logger.log(logging.DEBUG, "Found server from local ip/port: %s from %d", serveraddr, session_id) publicport = client_session['addr'][1] if client_session['localaddr'][1]: publicport = client_session['localaddr'][1] if client_session['serveraddr'] is not None: publicport = int( client_session['serveraddr']['publicport'] ) # Send to requesting client output = bytearray(recv_data[0:12]) output += bytearray([ int(x) for x in client_session['addr'][0].split('.') ]) output += utils.get_bytes_from_short(publicport, True) # Unknown, always seems to be \x42\x00 output += bytearray([0x42, 0x00]) output[7] = 0x05 # self.write_queue.put(( # output, # (client_id_session['addr']) # )) self.write_queue.put(( output, (client_id_session['addr'][0], client_id_session['addr'][1]) )) logger.log(logging.DEBUG, "Sent connection request to %s:%d...", client_id_session['addr'][0], client_id_session['addr'][1]) logger.log(logging.DEBUG, '%s', utils.pretty_print_hex(output)) # Send to other client # if client_id_session['serveraddr'] is None: serveraddr = self.get_server_info( gameid, session_id, client_id ) if serveraddr is None: serveraddr = self.get_server_info_alt( gameid, session_id, client_id ) client_id_session['serveraddr'] = serveraddr logger.log(logging.DEBUG, "Found server 2 from local ip/port: %s from %d", serveraddr, session_id) publicport = client_id_session['addr'][1] if client_id_session['localaddr'][1]: publicport = client_id_session['localaddr'][1] if client_id_session['serveraddr'] is not None: publicport = int( client_id_session['serveraddr']['publicport'] ) output = bytearray(recv_data[0:12]) output += bytearray( [int(x) for x in client_id_session['addr'][0].split('.')] ) output += utils.get_bytes_from_short(publicport, True) # Unknown, always seems to be \x42\x00 output += bytearray([0x42, 0x00]) output[7] = 0x05 # self.write_queue.put((output, (client_session['addr']))) self.write_queue.put((output, (client_session['addr'][0], client_session['addr'][1]))) logger.log(logging.DEBUG, "Sent connection request to %s:%d...", client_session['addr'][0], client_session['addr'][1]) logger.log(logging.DEBUG, '%s', utils.pretty_print_hex(output)) elif recv_data[7] == '\x06': # Was able to connect client_id = "%02x" % ord(recv_data[13]) logger.log(logging.DEBUG, "Received connected command from %s:%s...", addr[0], addr[1]) if session_id in self.session_list and \ client_id in self.session_list[session_id]: self.session_list[session_id][client_id]['connected'] = True elif recv_data[7] == '\x0a': # Address check. Note: UNTESTED! client_id = "%02x" % ord(recv_data[13]) logger.log(logging.DEBUG, "Received address check command from %s:%s...", addr[0], addr[1]) output = bytearray(recv_data[0:15]) output += bytearray([int(x) for x in addr[0].split('.')]) output += utils.get_bytes_from_short(addr[1], True) output += bytearray(recv_data[len(output):]) output[7] = 0x0b self.write_queue.put((output, addr)) logger.log(logging.DEBUG, "Sent address check response to %s:%d...", addr[0], addr[1]) logger.log(logging.DEBUG, "%s", utils.pretty_print_hex(output)) elif recv_data[7] == '\x0c': # Natify port_type = "%02x" % ord(recv_data[12]) logger.log(logging.DEBUG, "Received natify command from %s:%s...", addr[0], addr[1]) output = bytearray(recv_data) output[7] = 0x02 # ERT Test self.write_queue.put((output, addr)) logger.log(logging.DEBUG, "Sent natify response to %s:%d...", addr[0], addr[1]) logger.log(logging.DEBUG, "%s", utils.pretty_print_hex(output)) elif recv_data[7] == '\x0d': # Report logger.log(logging.DEBUG, "Received report command from %s:%s...", addr[0], addr[1]) logger.log(logging.DEBUG, "%s", utils.pretty_print_hex(recv_data)) # Report response output = bytearray(recv_data[:21]) output[7] = 0x0e # Report response output[14] = 0 # Clear byte to match real server's response self.write_queue.put((output, addr)) elif recv_data[7] == '\x0f': # Natneg v4 command thanks to Pipian. # Only seems to be used in very few DS games (namely, # Pokemon Black/White/Black 2/White 2). logger.log(logging.DEBUG, "Received pre-init command from %s:%s...", addr[0], addr[1]) logger.log(logging.DEBUG, "%s", utils.pretty_print_hex(recv_data)) session = utils.get_int(recv_data[-4:], 0) # Report response output = bytearray(recv_data[:-4]) + bytearray([0, 0, 0, 0]) output[7] = 0x10 # Pre-init response if not session: # What's the correct behavior when session == 0? output[13] = 2 elif session in self.natneg_preinit_session: # Should this be sent to both clients or just the one that # connected most recently? # I can't tell from a one sided packet capture of Pokemon. # For the time being, send to both clients just in case. output[13] = 2 self.write_queue.put((output, self.natneg_preinit_session[session])) output[12] = (1, 0)[output[12]] # Swap the index del self.natneg_preinit_session[session] else: output[13] = 0 self.natneg_preinit_session[session] = addr self.write_queue.put((output, addr)) else: # Was able to connect logger.log(logging.DEBUG, "Received unknown command %02x from %s:%s...", ord(recv_data[7]), addr[0], addr[1])
def handle_packet(self, socket, recv_data, address): # Tetris DS overlay 10 @ 02144184 - Handle responses back to server # Tetris DS overlay 10 @ 02144184 - Handle responses back to server # # After some more packet inspection, it seems the format goes something like this: # - All server messages seem to always start with \xfe\xfd. # - The first byte from the client (or third byte from the server) is a command. # - Bytes 2 - 5 from the client is some kind of ID. This will have to be inspected later. I believe it's a # session-like ID because the number changes between connections. Copying the client's ID might be enough. # # The above was as guessed. # The code in Tetris DS (overlay 10) @ 0216E974 handles the network command creation. # R1 contains the command to be sent to the server. # R2 contains a pointer to some unknown integer that gets written after the command. # # - Commands # Commands range from 0x00 to 0x09 (for client only at least?) (Tetris DS overlay 10 @ 0216DDCC) # # CLIENT: # 0x01 - Response (Tetris DS overlay 10 @ 216DCA4) # Sends back base64 of RC4 encrypted string that was gotten from the server's 0x01. # # 0x03 - Send client state? (Tetris DS overlay 10 @ 216DA30) # Data sent: # 1) Loop for each localip available on the system, write as localip%d\x00(local ip) # 2) localport\x00(local port) # 3) natneg (either 0 or 1) # 4) ONLY IF STATE CHANGED: statechanged\x00(state) (Possible values: 0, 1, 2, 3) # 5) gamename\x00(game name) # 6) ONLY IF PUBLIC IP AND PORT ARE AVAILABLE: publicip\x00(public ip) # 7) ONLY IF PUBLIC IP AND PORT ARE AVAILABLE: publicport\x00(public port) # # if statechanged != 2: # Write various other data described here: http://docs.poweredbygamespy.com/wiki/Query_and_Reporting_Implementation # # 0x07 - Unknown, related to server's 0x06 (returns value sent from server) # # 0x08 - Keep alive? Sent after 0x03 # # 0x09 - Availability check # # SERVER: # 0x01 - Unknown # Data sent: # 8 random ASCII characters (?) followed by the public IP and port of the client as a hex string # # 0x06 - Unknown # First 4 bytes is some kind of id? I believe it's a unique identifier for the data being sent, # seeing how the server can send the same IP information many times in a row. If the IP information has # already been parsed then it doesn't waste time handling it. # # After that is a "SBCM" section which is 0x14 bytes in total. # SBCM information gets parsed at 2141A0C in Tetris DS overlay 10. # Seems to contain IP address information. # # The SBCM seems to contain a little information that must be parsed before. # After the SBCM: # \x03\x00\x00\x00 - Always the same? # \x01 - Found player? # \x04 - Unknown # (2 bytes) - Unknown. Port? # (4 bytes) - Player's IP # (4 bytes) - Unknown. Some other IP? Remote server IP? # \x00\x00\x00\x00 - Unknown but seems to get checked # # Another SBCM, after a player has been found and attempting to start a game: # \x03\x00\x00\x00 - Always the same? # \x05 - Connecting to player? # \x00 - Unknown # (2 bytes) - Unknown. Port? Same as before. # (4 bytes) - Player's IP # (4 bytes) - Unknown. Some other IP? Remote server IP? # # 0x0a - Response to 0x01 # Gets sent after receiving 0x01 from the client. So, server 0x01 -> client 0x01 -> server 0x0a. # Has no other data besides the client ID. # # - \xfd\xfc commands get passed directly between the other player(s)? # # # Open source version of GameSpy found here: https://github.com/sfcspanky/Openspy-Core/tree/master/qr # Use as reference. session_id = None if recv_data[0] != '\x09': # Don't add a session if the client is trying to check if the game is available or not session_id = struct.unpack("<I", recv_data[1:5])[0] session_id_raw = recv_data[1:5] if session_id not in self.sessions: # Found a new session, add to session list self.sessions[session_id] = self.Session(address) self.sessions[session_id].session = session_id self.sessions[session_id].keepalive = int(time.time()) self.sessions[session_id].disconnected = False if session_id in self.sessions and self.sessions[session_id].disconnected == True: return if session_id in self.sessions: self.sessions[session_id].keepalive = int(time.time()) # Make sure the server doesn't get removed # Handle commands if recv_data[0] == '\x00': # Query self.log(logging.DEBUG, address, session_id, "NOT IMPLEMENTED! Received query from %s:%s... %s" % (address[0], address[1], recv_data[5:])) elif recv_data[0] == '\x01': # Challenge self.log(logging.DEBUG, address, session_id, "Received challenge from %s:%s... %s" % (address[0], address[1], recv_data[5:])) # Prepare the challenge sent from the server to be compared challenge = gs_utils.prepare_rc4_base64(self.sessions[session_id].secretkey, self.sessions[session_id].challenge) # Compare challenge client_challenge = recv_data[5:-1] if client_challenge == challenge: # Challenge succeeded # Send message back to client saying it was accepted packet = bytearray([0xfe, 0xfd, 0x0a]) # Send client registered command packet.extend(session_id_raw) # Get the session ID self.write_queue.put((packet, address)) self.log(logging.DEBUG, address, session_id, "Sent client registered to %s:%s..." % (address[0], address[1])) if self.sessions[session_id].heartbeat_data != None: self.update_server_list(session_id, self.sessions[session_id].heartbeat_data) else: # Failed the challenge, request another during the next heartbeat self.sessions[session_id].sent_challenge = False self.server_manager.delete_server(self.sessions[session_id].gamename, session_id) elif recv_data[0] == '\x02': # Echo self.log(logging.DEBUG, address, session_id, "NOT IMPLEMENTED! Received echo from %s:%s... %s" % (address[0], address[1], recv_data[5:])) elif recv_data[0] == '\x03': # Heartbeat data = recv_data[5:] self.log(logging.DEBUG, address, session_id, "Received heartbeat from %s:%s... %s" % (address[0], address[1], data)) # Parse information from heartbeat here d = data.rstrip('\0').split('\0') # It may be safe to ignore "unknown" keys because the proper key names get filled in later... k = {} for i in range(0, len(d), 2): #self.log(logging.DEBUG, address, session_id, "%s = %s" % (d[i], d[i+1])) k[d[i]] = d[i+1] if self.sessions[session_id].ingamesn != None: if "gamename" in k and "dwc_pid" in k: try: profile = self.db.get_profile_from_profileid(k['dwc_pid']) naslogin = self.db.get_nas_login_from_userid(profile['userid']) self.sessions[session_id].ingamesn = str(naslogin['ingamesn']) # convert to string from unicode(which is just a base64 string anyway) except Exception,e: pass # If the game doesn't have, don't worry about it. if self.sessions[session_id].ingamesn != None and "ingamesn" not in k: k['ingamesn'] = self.sessions[session_id].ingamesn if "gamename" in k: if k['gamename'] in self.secret_key_list: self.sessions[session_id].secretkey = self.secret_key_list[k['gamename']] else: self.log(logging.INFO, address, session_id, "Connection from unknown game '%s'!" % k['gamename']) if self.sessions[session_id].playerid == 0 and "dwc_pid" in k: # Get the player's id and then query the profile to figure out what console they are on. # The endianness of some server data depends on the endianness of the console, so we must be able # to account for that. self.sessions[session_id].playerid = int(k['dwc_pid']) # Try to detect console without hitting the database first found_console = False if 'gamename' in k: self.sessions[session_id].console = 0 if k['gamename'].endswith('ds') or k['gamename'].endswith('dsam') or k['gamename'].endswith('dsi') or k['gamename'].endswith('dsiam'): self.sessions[session_id].console = 0 found_console = True elif k['gamename'].endswith('wii') or k['gamename'].endswith('wiiam') or k['gamename'].endswith('wiiware') or k['gamename'].endswith('wiiwaream'): self.sessions[session_id].console = 1 found_console = True if found_console == False: # Couldn't detect game, try to get it from the database # Try a 3 times before giving up for i in range(0, 3): try: profile = self.db.get_profile_from_profileid(self.sessions[session_id].playerid) if "console" in profile: self.sessions[session_id].console = profile['console'] break except: time.sleep(0.5) if 'publicip' in k and k['publicip'] == "0": #and k['dwc_hoststate'] == "2": # When dwc_hoststate == 2 then it doesn't send an IP, so calculate it ourselves be = self.sessions[session_id].console != 0 k['publicip'] = str(utils.get_ip(bytearray([int(x) for x in address[0].split('.')]), 0, be)) if 'publicport' in k and 'localport' in k and k['publicport'] != k['localport']: self.log(logging.DEBUG, address, session_id, "publicport %s doesn't match localport %s, so changing publicport to %s..." \ % (k['publicport'], k['localport'], str(address[1]))) k['publicport'] = str(address[1]) if self.sessions[session_id].sent_challenge == True: self.update_server_list(session_id, k) else: addr_hex = ''.join(["%02X" % int(x) for x in address[0].split('.')]) port_hex = "%04X" % int(address[1]) server_challenge = utils.generate_random_str(6) + '00' + addr_hex + port_hex self.sessions[session_id].challenge = server_challenge packet = bytearray([0xfe, 0xfd, 0x01]) # Send challenge command packet.extend(session_id_raw) # Get the session ID packet.extend(server_challenge) packet.extend('\x00') self.write_queue.put((packet, address)) self.log(logging.DEBUG, address, session_id, "Sent challenge to %s:%s..." % (address[0], address[1])) self.sessions[session_id].sent_challenge = True self.sessions[session_id].heartbeat_data = k
def handle_packet(self, recv_data, addr): logger.log(logging.DEBUG, "Connection from %s:%d..." % (addr[0], addr[1])) logger.log(logging.DEBUG, utils.pretty_print_hex(recv_data)) # Make sure it's a legal packet if recv_data[0:6] != bytearray([0xfd, 0xfc, 0x1e, 0x66, 0x6a, 0xb2]): return session_id = struct.unpack("<I", recv_data[8:12])[0] session_id_raw = recv_data[8:12] # Handle commands if recv_data[7] == '\x00': logger.log( logging.DEBUG, "Received initialization from %s:%s..." % (addr[0], addr[1])) output = bytearray(recv_data[0:14]) output += bytearray( [0xff, 0xff, 0x6d, 0x16, 0xb5, 0x7d, 0xea] ) # Checked with Tetris DS, Mario Kart DS, and Metroid Prime Hunters, and this seems to be the standard response to 0x00 output[7] = 0x01 # Initialization response self.write_queue.put((output, addr)) # Try to connect to the server gameid = utils.get_string(recv_data, 0x15) client_id = "%02x" % ord(recv_data[13]) localip_raw = recv_data[15:19] localip_int_le = utils.get_ip(recv_data, 15) localip_int_be = utils.get_ip(recv_data, 15, True) localip = '.'.join(["%d" % ord(x) for x in localip_raw]) localport_raw = recv_data[19:21] localport = utils.get_short(localport_raw, 0, True) localaddr = (localip, localport, localip_int_le, localip_int_be) self.session_list.setdefault(session_id, {}).setdefault( client_id, { 'connected': False, 'addr': '', 'localaddr': None, 'serveraddr': None, 'gameid': None }) self.session_list[session_id][client_id]['gameid'] = gameid self.session_list[session_id][client_id]['addr'] = addr self.session_list[session_id][client_id]['localaddr'] = localaddr clients = len(self.session_list[session_id]) for client in self.session_list[session_id]: if self.session_list[session_id][client][ 'connected'] == False: # and self.session_list[session_id][client]['localaddr'][1] != 0: if client == client_id: continue #if self.session_list[session_id][client]['serveraddr'] == None: serveraddr = self.get_server_info(gameid, session_id, client) if serveraddr == None: serveraddr = self.get_server_info_alt( gameid, session_id, client) self.session_list[session_id][client][ 'serveraddr'] = serveraddr logger.log( logging.DEBUG, "Found server from local ip/port: %s from %d" % (serveraddr, session_id)) publicport = self.session_list[session_id][client]['addr'][ 1] if self.session_list[session_id][client]['localaddr'][ 1] != 0: publicport = self.session_list[session_id][client][ 'localaddr'][1] if self.session_list[session_id][client][ 'serveraddr'] != None: publicport = int(self.session_list[session_id][client] ['serveraddr']['publicport']) # Send to requesting client output = bytearray(recv_data[0:12]) output += bytearray([ int(x) for x in self.session_list[session_id][client] ['addr'][0].split('.') ]) output += utils.get_bytes_from_short(publicport, True) output += bytearray( [0x42, 0x00]) # Unknown, always seems to be \x42\x00 output[7] = 0x05 #self.write_queue.put((output, (self.session_list[session_id][client_id]['addr']))) self.write_queue.put((output, ( self.session_list[session_id][client_id]['addr'][0], self.session_list[session_id][client_id]['addr'][1]))) logger.log( logging.DEBUG, "Sent connection request to %s:%d..." % (self.session_list[session_id][client_id]['addr'][0], self.session_list[session_id][client_id]['addr'][1])) logger.log(logging.DEBUG, utils.pretty_print_hex(output)) # Send to other client #if self.session_list[session_id][client_id]['serveraddr'] == None: serveraddr = self.get_server_info(gameid, session_id, client_id) if serveraddr == None: serveraddr = self.get_server_info_alt( gameid, session_id, client_id) self.session_list[session_id][client_id][ 'serveraddr'] = serveraddr logger.log( logging.DEBUG, "Found server 2 from local ip/port: %s from %d" % (serveraddr, session_id)) publicport = self.session_list[session_id][client_id][ 'addr'][1] if self.session_list[session_id][client_id]['localaddr'][ 1] != 0: publicport = self.session_list[session_id][client_id][ 'localaddr'][1] if self.session_list[session_id][client_id][ 'serveraddr'] != None: publicport = int( self.session_list[session_id][client_id] ['serveraddr']['publicport']) output = bytearray(recv_data[0:12]) output += bytearray([ int(x) for x in self.session_list[session_id] [client_id]['addr'][0].split('.') ]) output += utils.get_bytes_from_short(publicport, True) output += bytearray( [0x42, 0x00]) # Unknown, always seems to be \x42\x00 output[7] = 0x05 #self.write_queue.put((output, (self.session_list[session_id][client]['addr']))) self.write_queue.put( (output, (self.session_list[session_id][client]['addr'][0], self.session_list[session_id][client]['addr'][1]))) logger.log( logging.DEBUG, "Sent connection request to %s:%d..." % (self.session_list[session_id][client]['addr'][0], self.session_list[session_id][client]['addr'][1])) logger.log(logging.DEBUG, utils.pretty_print_hex(output)) elif recv_data[7] == '\x06': # Was able to connect client_id = "%02x" % ord(recv_data[13]) logger.log( logging.DEBUG, "Received connected command from %s:%s..." % (addr[0], addr[1])) if session_id in self.session_list and client_id in self.session_list[ session_id]: self.session_list[session_id][client_id]['connected'] = True elif recv_data[7] == '\x0a': # Address check. Note: UNTESTED! client_id = "%02x" % ord(recv_data[13]) logger.log( logging.DEBUG, "Received address check command from %s:%s..." % (addr[0], addr[1])) output = bytearray(recv_data[0:15]) output += bytearray([int(x) for x in addr[0].split('.')]) output += utils.get_bytes_from_short(addr[1], True) output += bytearray(recv_data[len(output):]) output[7] = 0x0b self.write_queue.put((output, addr)) logger.log( logging.DEBUG, "Sent address check response to %s:%d..." % (addr[0], addr[1])) logger.log(logging.DEBUG, utils.pretty_print_hex(output)) elif recv_data[7] == '\x0c': # Natify port_type = "%02x" % ord(recv_data[12]) logger.log( logging.DEBUG, "Received natify command from %s:%s..." % (addr[0], addr[1])) output = bytearray(recv_data) output[7] = 0x02 # ERT Test self.write_queue.put((output, addr)) logger.log(logging.DEBUG, "Sent natify response to %s:%d..." % (addr[0], addr[1])) logger.log(logging.DEBUG, utils.pretty_print_hex(output)) elif recv_data[7] == '\x0d': # Report logger.log( logging.DEBUG, "Received report command from %s:%s..." % (addr[0], addr[1])) logger.log(logging.DEBUG, utils.pretty_print_hex(recv_data)) # Report response output = bytearray(recv_data[:21]) output[7] = 0x0e # Report response output[14] = 0 # Clear byte to match real server's response self.write_queue.put((output, addr)) elif recv_data[7] == '\x0f': # Natneg v4 command thanks to Pipian. # Only seems to be used in very few DS games (namely, Pokemon Black/White/Black 2/White 2). logger.log( logging.DEBUG, "Received pre-init command from %s:%s..." % (addr[0], addr[1])) logger.log(logging.DEBUG, utils.pretty_print_hex(recv_data)) session = utils.get_int(recv_data[-4:], 0) # Report response output = bytearray(recv_data[:-4]) + bytearray([0, 0, 0, 0]) output[7] = 0x10 # Pre-init response if session == 0: # What's the correct behavior when session == 0? output[13] = 2 elif session in self.natneg_preinit_session: # Should this be sent to both clients or just the one that connected most recently? # I can't tell from a one sided packet capture of Pokemon. # For the time being, send to both clients just in case. output[13] = 2 self.write_queue.put( (output, self.natneg_preinit_session[session])) output[12] = (1, 0)[output[12]] # Swap the index del self.natneg_preinit_session[session] else: output[13] = 0 self.natneg_preinit_session[session] = addr self.write_queue.put((output, addr)) else: # Was able to connect logger.log( logging.DEBUG, "Received unknown command %02x from %s:%s..." % (ord(recv_data[7]), addr[0], addr[1]))
def rawDataReceived(self, data): try: # First 2 bytes are the packet size. # # Third byte is the command byte. # According to Openspy-Core: # 0x00 - Server list request # 0x01 - Server info request # 0x02 - Send message request # 0x03 - Keep alive reply # 0x04 - Map loop request (?) # 0x05 - Player search request # # For Tetris DS, at the very least 0x00 and 0x02 need to be # implemented. self.buffer += data while len(self.buffer) > 0: packet_len = utils.get_short(self.buffer, 0, True) packet = None if len(self.buffer) >= packet_len: packet = self.buffer[:packet_len] self.buffer = self.buffer[packet_len:] if packet is None: # Don't have enough for the entire packet, break. break if packet[2] == '\x00': # Server list request self.log(logging.DEBUG, "Received server list request from %s:%s...", self.address.host, self.address.port) # This code is so... not python. The C programmer in me is # coming out strong. # TODO: Rewrite this section later? idx = 3 list_version = ord(packet[idx]) idx += 1 encoding_version = ord(packet[idx]) idx += 1 game_version = utils.get_int(packet, idx) idx += 4 query_game = utils.get_string(packet, idx) idx += len(query_game) + 1 game_name = utils.get_string(packet, idx) idx += len(game_name) + 1 challenge = ''.join(packet[idx:idx+8]) idx += 8 filter = utils.get_string(packet, idx) idx += len(filter) + 1 fields = utils.get_string(packet, idx) idx += len(fields) + 1 options = utils.get_int(packet, idx, True) idx += 4 source_ip = 0 max_servers = 0 NO_SERVER_LIST = 0x02 ALTERNATE_SOURCE_IP = 0x08 LIMIT_RESULT_COUNT = 0x80 send_ip = False if (options & LIMIT_RESULT_COUNT): max_servers = utils.get_int(packet, idx) elif (options & ALTERNATE_SOURCE_IP): source_ip = utils.get_ip(packet, idx) elif (options & NO_SERVER_LIST): send_ip = True if '\\' in fields: fields = [x for x in fields.split('\\') if x and not x.isspace()] # print "%02x %02x %08x" % \ # (list_version, encoding_version, game_version) # print "%s" % query_game # print "%s" % game_name # print "%s" % challenge # print "%s" % filter # print "%s" % fields # print "%08x" % options # print "%d %08x" % (max_servers, source_ip) self.log(logging.DEBUG, "list version: %02x / encoding version: %02x /" " game version: %08x / query game: %s /" " game name: %s / challenge: %s / filter: %s /" " fields: %s / options: %08x / max servers: %d /" " source ip: %08x", list_version, encoding_version, game_version, query_game, game_name, challenge, filter, fields, options, max_servers, source_ip) # Requesting ip and port of client, not server if not filter and not fields or send_ip: output = bytearray( [int(x) for x in self.address.host.split('.')] ) # Does this ever change? output += utils.get_bytes_from_short(6500, True) enc = gs_utils.EncTypeX() output_enc = enc.encrypt( self.secret_key_list[game_name], challenge, output ) self.transport.write(bytes(output_enc)) self.log(logging.DEBUG, "%s", "Responding with own IP and game port...") self.log(logging.DEBUG, "%s", utils.pretty_print_hex(output)) else: self.find_server(query_game, filter, fields, max_servers, game_name, challenge) elif packet[2] == '\x02': # Send message request packet_len = utils.get_short(packet, 0, True) dest_addr = '.'.join(["%d" % ord(x) for x in packet[3:7]]) # What's the pythonic way to do this? unpack? dest_port = utils.get_short(packet, 7, True) dest = (dest_addr, dest_port) self.log(logging.DEBUG, "Received send message request from %s:%s to" " %s:%d... expecting %d byte packet.", self.address.host, self.address.port, dest_addr, dest_port, packet_len) self.log(logging.DEBUG, "%s", utils.pretty_print_hex(bytearray(packet))) if packet_len == len(packet): # Contains entire packet, send immediately. self.forward_data_to_client(packet[9:], dest) else: self.log(logging.ERROR, "%s", "ERROR: Could not find entire packet.") elif packet[2] == '\x03': # Keep alive reply self.log(logging.DEBUG, "Received keep alive from %s:%s...", self.address.host, self.address.port) else: self.log(logging.DEBUG, "Received unknown command (%02x) from %s:%s...", ord(packet[2]), self.address.host, self.address.port) self.log(logging.DEBUG, "%s", utils.pretty_print_hex(bytearray(packet))) except: self.log(logging.ERROR, "Unknown exception: %s", traceback.format_exc())
def handle_packet(self, socket, recv_data, address): # Tetris DS overlay 10 @ 02144184 - Handle responses back to server # Tetris DS overlay 10 @ 02144184 - Handle responses back to server # # After some more packet inspection, it seems the format goes something like this: # - All server messages seem to always start with \xfe\xfd. # - The first byte from the client (or third byte from the server) is a command. # - Bytes 2 - 5 from the client is some kind of ID. This will have to be inspected later. I believe it's a # session-like ID because the number changes between connections. Copying the client's ID might be enough. # # The above was as guessed. # The code in Tetris DS (overlay 10) @ 0216E974 handles the network command creation. # R1 contains the command to be sent to the server. # R2 contains a pointer to some unknown integer that gets written after the command. # # - Commands # Commands range from 0x00 to 0x09 (for client only at least?) (Tetris DS overlay 10 @ 0216DDCC) # # CLIENT: # 0x01 - Response (Tetris DS overlay 10 @ 216DCA4) # Sends back base64 of RC4 encrypted string that was gotten from the server's 0x01. # # 0x03 - Send client state? (Tetris DS overlay 10 @ 216DA30) # Data sent: # 1) Loop for each localip available on the system, write as localip%d\x00(local ip) # 2) localport\x00(local port) # 3) natneg (either 0 or 1) # 4) ONLY IF STATE CHANGED: statechanged\x00(state) (Possible values: 0, 1, 2, 3) # 5) gamename\x00(game name) # 6) ONLY IF PUBLIC IP AND PORT ARE AVAILABLE: publicip\x00(public ip) # 7) ONLY IF PUBLIC IP AND PORT ARE AVAILABLE: publicport\x00(public port) # # if statechanged != 2: # Write various other data described here: http://docs.poweredbygamespy.com/wiki/Query_and_Reporting_Implementation # # 0x07 - Unknown, related to server's 0x06 (returns value sent from server) # # 0x08 - Keep alive? Sent after 0x03 # # 0x09 - Availability check # # SERVER: # 0x01 - Unknown # Data sent: # 8 random ASCII characters (?) followed by the public IP and port of the client as a hex string # # 0x06 - Unknown # First 4 bytes is some kind of id? I believe it's a unique identifier for the data being sent, # seeing how the server can send the same IP information many times in a row. If the IP information has # already been parsed then it doesn't waste time handling it. # # After that is a "SBCM" section which is 0x14 bytes in total. # SBCM information gets parsed at 2141A0C in Tetris DS overlay 10. # Seems to contain IP address information. # # The SBCM seems to contain a little information that must be parsed before. # After the SBCM: # \x03\x00\x00\x00 - Always the same? # \x01 - Found player? # \x04 - Unknown # (2 bytes) - Unknown. Port? # (4 bytes) - Player's IP # (4 bytes) - Unknown. Some other IP? Remote server IP? # \x00\x00\x00\x00 - Unknown but seems to get checked # # Another SBCM, after a player has been found and attempting to start a game: # \x03\x00\x00\x00 - Always the same? # \x05 - Connecting to player? # \x00 - Unknown # (2 bytes) - Unknown. Port? Same as before. # (4 bytes) - Player's IP # (4 bytes) - Unknown. Some other IP? Remote server IP? # # 0x0a - Response to 0x01 # Gets sent after receiving 0x01 from the client. So, server 0x01 -> client 0x01 -> server 0x0a. # Has no other data besides the client ID. # # - \xfd\xfc commands get passed directly between the other player(s)? # # # Open source version of GameSpy found here: https://github.com/sfcspanky/Openspy-Core/tree/master/qr # Use as reference. session_id = None if recv_data[0] != '\x09': # Don't add a session if the client is trying to check if the game is available or not session_id = struct.unpack("<I", recv_data[1:5])[0] session_id_raw = recv_data[1:5] if session_id not in self.sessions: # Found a new session, add to session list self.sessions[session_id] = self.Session(address) self.sessions[session_id].session = session_id self.sessions[session_id].keepalive = int(time.time()) self.sessions[session_id].disconnected = False if session_id in self.sessions and self.sessions[ session_id].disconnected == True: return if session_id in self.sessions: self.sessions[session_id].keepalive = int( time.time()) # Make sure the server doesn't get removed # Handle commands if recv_data[0] == '\x00': # Query self.log( logging.DEBUG, address, session_id, "NOT IMPLEMENTED! Received query from %s:%s... %s" % (address[0], address[1], recv_data[5:])) elif recv_data[0] == '\x01': # Challenge self.log( logging.DEBUG, address, session_id, "Received challenge from %s:%s... %s" % (address[0], address[1], recv_data[5:])) # Prepare the challenge sent from the server to be compared challenge = gs_utils.prepare_rc4_base64( self.sessions[session_id].secretkey, self.sessions[session_id].challenge) # Compare challenge client_challenge = recv_data[5:-1] if client_challenge == challenge: # Challenge succeeded # Send message back to client saying it was accepted packet = bytearray([0xfe, 0xfd, 0x0a]) # Send client registered command packet.extend(session_id_raw) # Get the session ID self.write_queue.put((packet, address)) self.log( logging.DEBUG, address, session_id, "Sent client registered to %s:%s..." % (address[0], address[1])) if self.sessions[session_id].heartbeat_data != None: self.update_server_list( session_id, self.sessions[session_id].heartbeat_data) else: # Failed the challenge, request another during the next heartbeat self.sessions[session_id].sent_challenge = False self.server_manager.delete_server( self.sessions[session_id].gamename, session_id) elif recv_data[0] == '\x02': # Echo self.log( logging.DEBUG, address, session_id, "NOT IMPLEMENTED! Received echo from %s:%s... %s" % (address[0], address[1], recv_data[5:])) elif recv_data[0] == '\x03': # Heartbeat data = recv_data[5:] self.log( logging.DEBUG, address, session_id, "Received heartbeat from %s:%s... %s" % (address[0], address[1], data)) # Parse information from heartbeat here d = data.rstrip('\0').split('\0') # It may be safe to ignore "unknown" keys because the proper key names get filled in later... k = {} for i in range(0, len(d), 2): #self.log(logging.DEBUG, address, session_id, "%s = %s" % (d[i], d[i+1])) k[d[i]] = d[i + 1] if self.sessions[session_id].ingamesn != None: if "gamename" in k and "dwc_pid" in k: try: profile = self.db.get_profile_from_profileid( k['dwc_pid']) naslogin = self.db.get_nas_login_from_userid( profile['userid']) self.sessions[session_id].ingamesn = str( naslogin['ingamesn'] ) # convert to string from unicode(which is just a base64 string anyway) except Exception, e: pass # If the game doesn't have, don't worry about it. if self.sessions[ session_id].ingamesn != None and "ingamesn" not in k: k['ingamesn'] = self.sessions[session_id].ingamesn if "gamename" in k: if k['gamename'] in self.secret_key_list: self.sessions[session_id].secretkey = self.secret_key_list[ k['gamename']] else: self.log( logging.INFO, address, session_id, "Connection from unknown game '%s'!" % k['gamename']) if self.sessions[session_id].playerid == 0 and "dwc_pid" in k: # Get the player's id and then query the profile to figure out what console they are on. # The endianness of some server data depends on the endianness of the console, so we must be able # to account for that. self.sessions[session_id].playerid = int(k['dwc_pid']) # Try to detect console without hitting the database first found_console = False if 'gamename' in k: self.sessions[session_id].console = 0 if k['gamename'].endswith('ds') or k['gamename'].endswith( 'dsam') or k['gamename'].endswith( 'dsi') or k['gamename'].endswith('dsiam'): self.sessions[session_id].console = 0 found_console = True elif k['gamename'].endswith( 'wii') or k['gamename'].endswith( 'wiiam') or k['gamename'].endswith( 'wiiware') or k['gamename'].endswith( 'wiiwaream'): self.sessions[session_id].console = 1 found_console = True if found_console == False: # Couldn't detect game, try to get it from the database # Try a 3 times before giving up for i in range(0, 3): try: profile = self.db.get_profile_from_profileid( self.sessions[session_id].playerid) if "console" in profile: self.sessions[session_id].console = profile[ 'console'] break except: time.sleep(0.5) if 'publicip' in k and k[ 'publicip'] == "0": #and k['dwc_hoststate'] == "2": # When dwc_hoststate == 2 then it doesn't send an IP, so calculate it ourselves be = self.sessions[session_id].console != 0 k['publicip'] = str( utils.get_ip( bytearray([int(x) for x in address[0].split('.')]), 0, be)) if 'publicport' in k and 'localport' in k and k['publicport'] != k[ 'localport']: self.log(logging.DEBUG, address, session_id, "publicport %s doesn't match localport %s, so changing publicport to %s..." \ % (k['publicport'], k['localport'], str(address[1]))) k['publicport'] = str(address[1]) if self.sessions[session_id].sent_challenge == True: self.update_server_list(session_id, k) else: addr_hex = ''.join( ["%02X" % int(x) for x in address[0].split('.')]) port_hex = "%04X" % int(address[1]) server_challenge = utils.generate_random_str( 6) + '00' + addr_hex + port_hex self.sessions[session_id].challenge = server_challenge packet = bytearray([0xfe, 0xfd, 0x01]) # Send challenge command packet.extend(session_id_raw) # Get the session ID packet.extend(server_challenge) packet.extend('\x00') self.write_queue.put((packet, address)) self.log( logging.DEBUG, address, session_id, "Sent challenge to %s:%s..." % (address[0], address[1])) self.sessions[session_id].sent_challenge = True self.sessions[session_id].heartbeat_data = k