Mario Kart World

This page contains research notes on LAN mode in Mario Kart World.

Browse Request

Below is an example of a browse request that is sent by Mario Kart World:

0000000016000000000000000000180018000e0400c3f00006e0000401010000000000000001197d2ad107ce343cc894138d073d5488df90c4fe7014573e0de4f343a499ac84f39c716888cf3568832d213ea0b8557cd84683a40923925bb4c9006558fd11864cfffe9e0ff9704b6e18fd7ee7e6083e670b748810028aaffeb8c92b4d34cca50dedb7b7cfbb491f55a709926262cb1c561399a00fdd802b0ad2ce800ea240ac170ef79dec820d6c533d507706b6addc06c97ee5f68b9163471d29cf2401beac59d9c449552a10c6a0eca963ab73b417709de63c447999e51e43174709e8f08837140021ddf084fee82648564cf559fb39508f80466dce989b61c3f76ec64510bc37bdbcc08841fd51a0818ee088a7c0eb3b72fddf58deb6a40b71e59323e95012ebd3bccc9deffd2ca07a1417b1e85a46a4e366fe8bd7436391f0e7faf3c76a

Unpacked:

00: packet type (browse request)
00000016: size of search network setting

0000000000000000: matchmake key
0018: maximum number of stations (upperbound)
0018: maximum number of stations (lowerbound)
000e: flags (opened only, check maximum number of stations, check matchmake key)
0400c3f00006e000: title id

04: crypto challenge version
01: crypto challenge enabled
01: sequence id
0000000000000001: nonce
197d2ad107ce343cc894138d073d5488: challenge key (random)
df90c4fe7014573e0de4f343a499ac84: AES-GCM MAC
f39c716888cf3568832d213ea0b8557cd84683a40923925bb4c9006558fd11864cfffe9e0ff9704b6e18fd7ee7e6083e670b748810028aaffeb8c92b4d34cca50dedb7b7cfbb491f55a709926262cb1c561399a00fdd802b0ad2ce800ea240ac170ef79dec820d6c533d507706b6addc06c97ee5f68b9163471d29cf2401beac59d9c449552a10c6a0eca963ab73b417709de63c447999e51e43174709e8f08837140021ddf084fee82648564cf559fb39508f80466dce989b61c3f76ec64510bc37bdbcc08841fd51a0818ee088a7c0eb3b72fddf58deb6a40b71e59323e95012ebd3bccc9deffd2ca07a1417b1e85a46a4e366fe8bd7436391f0e7faf3c76a: crypto challenge

Browse Reply

Below is an example of a browse reply:

010000022d40add59cd3b2a8c0007c160007000000000000000000000000000000000101000000060159616e6e696bae1cd4db4ccf460e4106521c163279bf0000000000000000000000000000000000000000000000000000000000000000000000000000000000007a2de9e5ef9594f799477ba38afa481b197d2ad107ce343cc894138d073d5488590061006e006e0069006b0000007c951c000000044e390a81ba1776f8687c951c000000ec4d390a0000000056ae6a8bb5255d5e00000000eb646ffb73aff78a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000bc000000000000000000010018010101c0a8b2d3000000000000000000000000c00004010100000000000000017a2de9e5ef9594f799477ba38afa481ba5176ef1e352cfe9faba63c6b2babcbcf5a847c7406d8f6cef42ac596a000c93

Unpacked:

01: packet type (browse reply)
0000022d: size of network property

40add59cd3b2a8c0: network id

007c: size of system property data
16: system communication version
0007: application communication version
00000000000000000000000000000000: user password
01: has player number limit
01: current number of players
00000006: host player name size
01: host player name encoding (UTF-8)
59616e6e696b: host player name
ae1cd4db4ccf460e4106521c163279bf: unknown
000000000000000000000000000000000000000000000000000000000000000000000000000000000000: padding
7a2de9e5ef9594f799477ba38afa481b197d2ad107ce343cc894138d073d5488: session key param

590061006e006e0069006b0000007c951c000000044e390a81ba1776f8687c951c000000ec4d390a0000000056ae6a8bb5255d5e00000000eb646ffb73aff78a: application data
000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000: padding
000000bc: property data size

0000000000000000: matchmake key
0001: current number of stations
0018: maximum number of stations
01: is openend
01: has player number limit
01: current number of players

c0a8b2d3000000000000000000000000: host IP (192.168 .178.211)
c000: host port (49152)

04: crypto challenge version
01: crypto challenge enabled
01: sequence id
0000000000000001: nonce
7a2de9e5ef9594f799477ba38afa481b: challenge key
a5176ef1e352cfe9faba63c6b2babcbc: AES-GCM MAC
f5a847c7406d8f6cef42ac596a000c93: challenge response

Application Data

The application data seems to be structured as follows:

Offset	Size	Description
0x0	22	Player name (UTF-16-LE, null-terminated)
0x16	22	Unknown
0x2C	4	Character id
0x30	4	Sticker id
0x34	4	Unknown
0x38	8	Unknown

A number of character ids have been documented here.