Gamestats server crashes Metroid Prime Hunters

[ToadKing]

When trying to use the custom gamestats server in Metroid Prime Hunters, the game crashes on connecting. Setting the gamestats server DNS to a dummy IP address allows the game to bypass the crash.

Network dump of crash: http://save-nintendo-wifi.com/crash.pcap

It might be the challenge key is too big. Normally the size of the return data in that last packet before the crash is 200 bytes instead of the 296 bytes on the custom server.

[polaris-]

That is definitely a possibility. The reason I originally restricted how much data I sent to in the beginning with Tetris DS is also because of a crash.

Does this bug also apply to not being able to reconnect after disconnecting in Metroid Prime: Hunters?

[ToadKing]

From what I've tested, no. That bug is triggered by something else, probably not going through the entire gameserver sequence successfully, so the game assumes that the server is down.

[polaris-]

Alright. I just tried with the updated gamestats stuff and it still doesn't work properly for me as far as relogging in goes. I'll compare some packets of a simple login and logout from both servers to see where it's different and go from there.

[polaris-]

Alright, so I've gone over everything and I can't find any real differences. Everything is really small at this point. The biggest of the differences is that the userid seems to be wrong. The userid sent from the DS is not the same as the userid that GameSpy returns, but I tried fixing that (even returning exactly what the real servers returns for my DS) and it doesn't fix it.

The next thing after that is that the headers for conntest and NAS don't match exactly what the real server returns. I went over gamestats and all of the data is the same aside from some of the obvious non-static information stuff. The sequence of commands and the returns are all as expected when comparing packet dumps. Maybe it's something subtler?

[ToadKing]

I don't think that the HTTP headers on the NAS server would be causing it, since it appears those changed once the Wii was launched and there wasn't a problem then. It could be that some token we think is random really isn't and it fails some verification, but outside of ROM hacking there won't be much luck in finding out what token it is, and what it should be.

[polaris-]

Yeah, I don't think changing the headers would have much effect really.

Ah yeah, that's the other possibility I was considering. The I've never seen the lt token actually checked, but I haven't checked Metroid Prime: Hunters to see if it happens to check it. Luckily, I do a lot of reverse engineering (including Nintendo DS), so I should be able to check that out myself (that's how I originally figured out how to generate the signatures and stuff before). If it's verifying one of the random tokens somewhere then it should be able to figure out how it generates what it's comparing with.

Looking at the server code again, it seems the only things besides session ids and the auth token that use a randomly generated string are the sig and used in getprofile and when you add a buddy, and then the lt token during login. I guess it doesn't hurt looking into it.

[polaris-]

I think I'm out of ideas now. I believe it's somewhere in the profile server but I can't figure out where exactly. I disabled all of the servers besides NAS and the profile server which were redirected to the Nintendo servers, and those worked. Then I tried with mine and then it doesn't let you log in again.

I set a breakpoint on the data from \lt\ and it never gets hit, so I don't think that gets checked. I even tried with an \lt\ returned by the real server and it made no difference. If proof is wrong then the game will internally show an error saying the the server could not be authenticated, so the proof is correct. I tried using the userid and profile id returned by the real server and that didn't fix anything either.

I'm not sure when or if I'll be able to fix this problem. Someone else might have to debug it maybe. Or we might have to find more games affected by the bug, if there are any.