Difference between revisions of "Wiimms mkw-ana (tool)"

From Custom Mario Kart
Jump to navigation Jump to search
(built-in help)
 
(85 intermediate revisions by 12 users not shown)
Line 1: Line 1:
−
The tools '''mkw-ana''' is a new project by [[Wiimm]] to analyze the network protocol of [[Mario Kart Wii]].
+
{| class="textbox float-right grid"
 +
|+ Wiimms mkw-ana
 +
| colspan=2 style="text-align:center" | [[File:Wiimms SZS Tools Logo.png]]
 +
|-
 +
! Author:
 +
| [[user:Wiimm|Wiimm]]
 +
|-
 +
! Operating Systems:
 +
| Linux (i386,x86_64),<br/>Windows (Cygwin).
 +
|-
 +
! Software Type:
 +
| Mario Kart Wii network traffic analyzer
 +
|-
 +
! File Formats:
 +
| PCAP 2.4, PCAP 2.4.modified, PCAP-NG, bzip2 compression, [[BMG]] (text).
 +
|-
 +
! Current Version:
 +
| v1.15, 2017-08-21
 +
|-
 +
! Homepage:
 +
| [http://mkw-ana.wiimm.de/ mkw-ana.wiimm.de]
 +
|-
 +
! Download:
 +
| [http://download.wiimm.de/mkw-ana/ download.wiimm.de]
 +
|}
 +
 
 +
'''mkw-ana''' is a tool by [[Wiimm]] to analyze the network protocol of [[Mario Kart Wii]]. It can also print infos about current races and detect the usage of different cheats and used glitches.
  
  
Line 5: Line 31:
  
  
−
{{textbox|red center|In Progress|This article is managed by [[Wiimm]] will grow slowly. Feel free to edit typos and grammatical or speech issues.}}
+
== Intention ==
 +
 
 +
In November 2012, [[Wiimm]] decided to analyze the network protocol of [[Mario Kart Wii]]. The main goal was to discover online cheaters. Another goal was to set up his own server if [[Nintendo]] ever shut down its servers, which eventually happened on May 20th, 2014.
  
 +
The main feature is to dump the packets of a tcpdump (done by ''tcpdump'' or ''wireshark'') in a user-friendly format. After first experiments, it also became a ''live racing statistic tool''.
  
−
== Intention ==
+
== The Tool ==
  
−
In November 2012, [[Wiimm]] decided to analyze the network protocol of [[Mario Kart Wii]]. The main goal was to discover online cheaters. Another goal is to set up his own server if any time [[Nintendo]] will shut down its servers.
+
Based on new knowledge made with [[Wiimmfi]] development, [[Wiimm]] has restructured '''mkw-ana'''. The important changes since v1.02 are:
 +
* New record analysis.
 +
* Improved detection of race type (racing, balloon, coin, team, global, private room) and race stages.
 +
* Improved detection of current active players.
 +
* Improved hex dumps.
 +
* Complete new RACE command:
 +
** It shows battles and normal races.
 +
** It shows the in-game players while in VIEW mode.
 +
** Log messages are printed in an own scroll region.
 +
**  special tables that shows client and racing slot usage.
 +
* Friend code calculation by Wii or by NDS mode.
 +
** Support of an internal database to find the correct friend code calculation. This database can be modified by external files.
 +
* Support of an internal secret database. It is needed to decode MS answers. This database can be modified by external files.
 +
* User defined race and statistics tables. The columns can be enabled and ordered by the new option --table. Alternatively the table definitions can be exported by '''mkw-ana tables'', edited and then read by option --tfile.
 +
* Configurable tables: Columns can be selected and ordered by options or definiton files.
 +
* A backend server:
 +
** The backend server is enabled by option --cmd <ADDRESS>:<PORT> or --cmd unix:<FILE>.
 +
** The number of backend clients is not limited.
 +
** The backend server work either in a simple stream modus (use e.g. '''ncat''' or '''netcat''' for it) or in interactive modus using telnet negotiations.
 +
** The server has an built-in help. Just type "HELP".
  
−
So the main feature is to dump the packets of a tcpdump (done by ''tcpdump'' or ''wireshark'') in a user-friendly format. After first experiments, it becomes also a ''live racing statistic tool''.
+
With v1.07, mkw-ana can send ban jobs to Wiimmfi if a not allowed cheat is detected and the user have the rights to ban.
 +
* Using of 19 different glitches is checked. Some of them may trigger an autnoatic ban.
 +
* Many item cheats are detected. Because of to less packets false positives are possible. But if really an item cheat is used, the item cheat counter goes >4 in a race.
 +
* Instant drift is detected. A relative rate is used as trigger to avoid false positives.
 +
* Moving around before race start is detected.
 +
* Enabling an item before race start is detected.
 +
* Manipulation of finish time is detected.
  
−
== The Tool ==
+
With v1.13, the GPCM server send extra message to inform the cleint about room players and their status. mkw-ana extract these infos and creates a room table. But the new room status is not used at the frontend yet and only available at by beackend comamnd »WIIMMFI«. Try »WATCH WIIMMFI«.
  
−
=== Built-in Help ===
+
=== Change log ===
  
−
Let's start with the build-in help as an overview about the tool:
 
 
<pre>
 
<pre>
−
Usage: mkw-ana [option]... [dumpfile]...
+
mkw-ana v1.15 r2787 - 2017-08-21
  
−
Commands:
+
- Backend command »WIIMMFI« improved. Try »WATCH WIIMMFI«.
  
−
  HELP                  Print this help and exit.
+
- \wiimmfi\: New data about inactive clients scanned and used.
−
  DEVELOP              Special development tests.
 
−
  TEST                  Test options.
 
  
−
  D1|DUMP2 [file]...   Dump all or filtered packets (method 'UDP').
+
- New frontend command: BACKEND:
−
  D2|DUMP2 [file]...   Dump all or filtered packets (method 'record').
+
   The frontend works like an interactive backend connection. (EXPERIMENTAL)
−
  D3|DUMP3 [file]...    New variant of DUMP2.
 
−
  DX|DUMPX [file]...    Experimental dump of all or filtered packets.
 
−
  D|DUMP [file]...      Use the best dumping method by analyzing the options.
 
  
−
  F|FLOWRATES [file]... Print flowrates. Use --brief for final stat only.
+
- Different minor updates.
−
  C|CLIENTS [file]...  List all clients.
 
−
  U|USERS [file]...    List all users.
 
−
  R|RECORDS [file]...  Print all record names.
 
−
  S|STAGES [file]...    Print all stages.
 
−
  L|LOG [file]...      Print all stages including tables.
 
−
  T|TOTALS [file]...    Print all totals as text dump.
 
  
−
  RACE [file]...        Live dump of the race to the screen.
+
- Windows only: Cygwin update to v2.8.1, 2017-07-03.
  
−
Options:
 
  
−
  -h --help          : Print this help and exit.
+
mkw-ana v1.14 r2631 - 2016-12-08
−
  -w --width          : Define terminal width.
 
−
  -O --old            : Enable old features and disable --new.
 
−
  -N --new            : Enable new features and disable --old.
 
  
−
    --sleep float    : Sleep seconds after race finished.
+
- Detection of GPCM \wiimmfi\...\final\ packets.
−
    --skip  float    : Skip first seconds if each tcpdump.
+
    - The statistics table is only available at the backend yet.
−
                        Negative values are relative to the end (not stdin).
+
     - Update of peer-connection flags.
−
    --term  float    : terminate each dump at timestamp (seconds).
 
−
                        Negative values are relative to the end (not stdin).
 
−
    --combine        : Combine dumps to one for --skip and --term.
 
−
  -W --write file     : Write filtered packets as PCAP to the file.
 
−
    --home addr      : Define an IP (or name) as home client.
 
  
−
  -p --no-proxy      : Ignore proxy records.
+
  - Bug fix: Command FLOWRATES failed sometimes.
−
  -r --receive        : Select received packages.
 
−
  -s --send          : Select send packages.
 
−
  -L --length ranges : Select only UDP packages with data len.
 
−
  -I --index ranges  : Print only bytes of range list.
 
−
  -S --stage list    : Select stage types, print only matched records.
 
−
  -t --type list      : Select record types, print packet if one record match.
 
−
  -T --TYPE list      : Select record types, print only matched records.
 
  
−
  -b --brief          : Suppress header info.
+
- Bug fix: Better detection of invalid STATUS packages. A warning is printed.
−
  -l --long          : Extended header info.
 
−
    --rel            : Print timestamps as relative seconds.
 
−
  -1 --one-line      : Dump one line per record.
 
−
                        If set twice, bind race records to one record.
 
−
  -a --ascii          : Append ASCII character dump.
 
−
  -x --hex-only      : Suppress AI and dump only hex values.
 
−
  -f --follow        : Follow last input file like 'tail -f'
 
  
−
    --log  file      : Log into the file. If first char is a '+', append data.
+
- New option: --warn-mode=LIST: Define, which warnings are enabled:
−
    --md  file      : Create a MakeDoc script with results after each race.
+
    - LENGTH  : Racing records with wrong length.
−
    --mdx file      : Same as --md, but replace %E, %R, %N and %T in 'file'
+
    - XLENGTH : Like RACE but be more verbose.
−
                        by 'event id', 'race id', 'total race' and 'event type'.
+
    - STATUS : Invalid STATUS records.
−
    --php file      : Create a php script with results after each race.
+
    - EVENT  :  Unknown event found.
−
    --phpx file      : Same as --php, but replace %E, %R, %N and %T in 'file'
+
    - DEFAULT := LENGTH | XLENGTH | STATUS
−
                        by 'event id', 'race id', 'total race' and 'event type'.
+
    - ALL and NONE are also possible.
−
    --mii dir        : Command USERS: Extract Miis to existing directory 'dir'.
+
 
 +
- Command SILENT is now silent again. It also disables all warnings.
 
</pre>
 
</pre>
 +
 +
&rarr; [http://mkw-ana.wiimm.de/changelog.html old logs]
 +
  
 
=== General Description ===
 
=== General Description ===
−
???
 
  
−
=== Dumping Data ===
+
The tool started as simple hex dumper reading network dumps in PCAP format. In the first phase of the tool, the textual dumps of ''wireshark'' and ''tcpdump'' were much better. But after only a few days, the tool learned to handle records, clients, users, friend codes and Miis. From this moment the tool was better to analyze the [[Mario Kart Wii]] traffic.
 +
 
 +
Now, mkw-ana split the traffic into records and scans some data to detect stages of the online meetings. Stages are for example ''room'', ''prepare race'', ''count down'', ''racing'' and ''end of race''. It is able to separate races into events (''grand prix'' and ''team grand prix'') and to calculate racing tables. Racing data can also be exported to support live statistics.
 +
 
 +
At the moment there are four different kinds of hexdumps. All 4 are able to dump in one line mode to have large tables. Tool ''less'' is here a very good tool for vertical and horizontal scrolling. The stages are includes into the dump as comment lines. The dumped records can be filters by sending, receiving, proxy, record types, stage types and packet length. It is also possible to select the dumped bytes by indices and ranges.
 +
 
 +
With beginning of version 1.02, [[Wiimm]] used the knowledge of the [[Wiimmfi]] development to re-implement record and stage detection. For example: If you enter a game in visitor modus, then mkw-ana shows racing data before you can see anything of the race on the screen.
 +
 
 +
Since version 1.06, mkw-ana has a built-in backend server. The user can login with any telnet client and can e.g. reconfigure the table layout or request tables of old races or control the autoban system.
  
−
=== Options ===
 
 
=== Download ===
 
=== Download ===
  
−
I plan to create a distribution of my tool. It will be available for Linux and as Cygwin version in some weeks.
+
;You can find the latest and some old distributions here:
 +
* http://download.wiimm.de/mkw-ana/
 +
 
 +
;Content:
 +
* Binaries for:
 +
** Linux i386
 +
** Linux x86_64
 +
** Cygwin/Windows (Needed Cygwin<ref>[http://cygwin.com/ Cygwin], a Linux like environment for Windows.</ref> DLL files are delivered. Best is to install a Cygwin system).
 +
* Some scripts as examples.
 +
* Some BMG text examples.
 +
* Some doc files.
 +
 
 +
;Sometimes I upload single tool updates (beta versions) for testers:
 +
* http://download.wiimm.de/mkw-ana/bin/
  
 
== Capture the network data ==
 
== Capture the network data ==
Line 102: Line 144:
 
First you must capture the network traffic of the [[Wii]]. Therefore you must redirect it to a PC running a capture software. There are 3 general ways to to this:
 
First you must capture the network traffic of the [[Wii]]. Therefore you must redirect it to a PC running a capture software. There are 3 general ways to to this:
 
* If you have a manageable switch, enable port mirroring and send all Wii traffic to a PC.
 
* If you have a manageable switch, enable port mirroring and send all Wii traffic to a PC.
−
* User your PC as router.
+
* Use your PC as router.
−
* Use old Hubs (not switches). A hub will mirror all traffic of all ports to all others; it's just a repeater and will slow down your network.
+
* Use old network hubs (not switches). A hub will mirror all traffic of all ports to all others; it's just a ''multi port repeater'' and will slow down your network.
  
 
Use a software like '''tcpdump''' or '''wireshark''' to capture the data. Best is to save the captured data directly to a file or to send it to other commands like '''mkw-ana''' for a live analysis.   
 
Use a software like '''tcpdump''' or '''wireshark''' to capture the data. Best is to save the captured data directly to a file or to send it to other commands like '''mkw-ana''' for a live analysis.   
Line 109: Line 151:
 
It's also possible to save the data to a file and to make a live analysis at the same time. Use the following command pipe:
 
It's also possible to save the data to a file and to make a live analysis at the same time. Use the following command pipe:
 
  tcpdump -w- -U -i eth1 host wii | tee save.dump | mkw-ana ...
 
  tcpdump -w- -U -i eth1 host wii | tee save.dump | mkw-ana ...
 +
It is important to filter the data by '''host ip_or_name''', because foreign traffic interfere the wii traffic analysis and will have curious side effects.
  
 
If using wireshark, save the dump to a file and use the following command for a live analysis:
 
If using wireshark, save the dump to a file and use the following command for a live analysis:
−
  mkw-ana --follow DUMPFILE ...
+
  mkw-ana COMMAND --follow DUMPFILE ...
 +
DUMPFILE can not only be a standard file, it can also be a socket or a ZCP7IP connection.
 +
 
 +
See »[[Dumping Network Traffic]]« more more details.
  
−
== Live Statistics ==
+
=== Accepted file formats ===
 +
 
 +
''mkw-ana'' accepts the following file formats for the network dumps:
 +
 
 +
* '''PCAP 2.4 :''' Standard packet capturing file format<ref>Wireshark: [http://wiki.wireshark.org/Development/LibpcapFileFormat LIBPCAP file format]</ref>.
 +
** Big and little [[endian]] are supported.
 +
** Timestamps in micro- and in nanoseconds are supported.
 +
 
 +
* '''PCAP 2.4.modified :''' Like PCAP, but with an extend packet header. This format is used by several routers, AVM FRITZ!Box<ref>[http://www.avm.de/ AVM FRITZ!Box], a widely used router in Germany</ref> is one example.
 +
** Big and little [[endian]] are supported.
 +
** Only microseconds timestamps are supported.
  
−
'''mkw-ana''' can scan the network traffic in real time and can produce ''makedoc'' or ''php'' data files. Together with '''ssh''' and an '''cgi script''', a [http://wiimm.de/mkw-race live statistic] is created. Live means that the tables are updates 2-5 seconds after the race have finished.
+
* '''PCAP-NG 2.4.modified :''' A next generation (NG) PCAP format<ref>Wincap: [http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html The next generation PCAP file format]</ref>.
 +
** Big and little [[endian]] are supported.
 +
** Microseconds timestamps are assumed, other are not supported.
 +
** Only the ''Enhanced Packet Block''<ref>Wincap: [http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html#sectionepb PCAP-NG, Enhanced Packet Block]</ref> is supported to retrieve packets.
  
−
=== How it works ===
+
* '''BZIP2 compression'''
 +
** ''mkw-ana'' detects a BZIP2 compression automatically. It is supported for all other dump file formats.
  
−
The whole job is done by 3 processes:
+
''mkw-ana'' accepts any list of dump files. The file format is detected for each single input file, so mixed formats are possible. The special file name »-« (minus sign) means: Don't open the file and and read the standard input (stdin) instead. So one of the input files can be read via pipe.
−
<ol>
 
−
<li>
 
−
First, you must capture the network traffic like described above. Then use one of the commands:
 
−
<pre>
 
−
... | mkw-ana log --md  DATAFILE
 
−
... | mkw-ana log --php DATAFILE
 
−
mkw-ana --follow DUMPFILE log --md  DATAFILE
 
−
mkw-ana --follow DUMPFILE log --php DATAFILE
 
−
</pre>
 
  
−
<li>
+
== Live Statistics ==
−
Each time, a new DATAFILE is written, it must be transferred to the web server. A script using '''shh''', '''sftp''' '''scp''' or '''ftp''' within an endless loop will do this job automatically.
 
  
−
<li>
+
'''mkw-ana''' can scan the network traffic in real time print a complete race statistics and more at the text screen. Moreover it can create ''makedoc'' or ''php'' data files after each race to create.
−
Last not least, a CGI or PHP script running at the web server must read the data files to serve a html-page to the visitors.
 
−
</ol>
 
  
−
To see, what live means, visit the [http://wiimm.de/mkw-race live statistics] on Wednesday or Thursday between 19:10 and 20:30 CET (Central European Time).
+
First, you must capture the network traffic like described above. Then use one of the commands:
 +
<pre>
 +
... | mkw-ana race
 +
mkw-ana race --follow DUMPFILE
 +
</pre> With this command you'll see information about selected the track, entering the room and a live game statistics. Important infos about cheats and glitches are added if detected.
  
 
== Links ==
 
== Links ==
 +
* [[Network Protocol]]
 +
* [http://forum.wii-homebrew.com/board42-kreativitaet/development/47289-wiimms-mkw-ana-tool/ Discussion at Wii-Homebrew.com] (german forum)
  
−
* [[MKWii Network Protocol]]
+
=== References ===
−
* [http://www.mariokartwii.com/f101/mkw-ana-mario-kart-wii-network-protocol-109421.html Discussion at mariokartwii.com]
+
<references/>
  
 +
{{Network Protocol}}
 
[[Category:Software]]
 
[[Category:Software]]
 +
[[Category:Network Protocol]]

Latest revision as of 11:38, 29 April 2023

Wiimms mkw-ana
Wiimms SZS Tools Logo.png
Author: Wiimm
Operating Systems: Linux (i386,x86_64),
Windows (Cygwin).
Software Type: Mario Kart Wii network traffic analyzer
File Formats: PCAP 2.4, PCAP 2.4.modified, PCAP-NG, bzip2 compression, BMG (text).
Current Version: v1.15, 2017-08-21
Homepage: mkw-ana.wiimm.de
Download: download.wiimm.de

mkw-ana is a tool by Wiimm to analyze the network protocol of Mario Kart Wii. It can also print infos about current races and detect the usage of different cheats and used glitches.



Intention

In November 2012, Wiimm decided to analyze the network protocol of Mario Kart Wii. The main goal was to discover online cheaters. Another goal was to set up his own server if Nintendo ever shut down its servers, which eventually happened on May 20th, 2014.

The main feature is to dump the packets of a tcpdump (done by tcpdump or wireshark) in a user-friendly format. After first experiments, it also became a live racing statistic tool.

The Tool

Based on new knowledge made with Wiimmfi development, Wiimm has restructured mkw-ana. The important changes since v1.02 are:

  • New record analysis.
  • Improved detection of race type (racing, balloon, coin, team, global, private room) and race stages.
  • Improved detection of current active players.
  • Improved hex dumps.
  • Complete new RACE command:
    • It shows battles and normal races.
    • It shows the in-game players while in VIEW mode.
    • Log messages are printed in an own scroll region.
    • special tables that shows client and racing slot usage.
  • Friend code calculation by Wii or by NDS mode.
    • Support of an internal database to find the correct friend code calculation. This database can be modified by external files.
  • Support of an internal secret database. It is needed to decode MS answers. This database can be modified by external files.
  • User defined race and statistics tables. The columns can be enabled and ordered by the new option --table. Alternatively the table definitions can be exported by 'mkw-ana tables, edited and then read by option --tfile.
  • Configurable tables: Columns can be selected and ordered by options or definiton files.
  • A backend server:
    • The backend server is enabled by option --cmd <ADDRESS>:<PORT> or --cmd unix:<FILE>.
    • The number of backend clients is not limited.
    • The backend server work either in a simple stream modus (use e.g. ncat or netcat for it) or in interactive modus using telnet negotiations.
    • The server has an built-in help. Just type "HELP".

With v1.07, mkw-ana can send ban jobs to Wiimmfi if a not allowed cheat is detected and the user have the rights to ban.

  • Using of 19 different glitches is checked. Some of them may trigger an autnoatic ban.
  • Many item cheats are detected. Because of to less packets false positives are possible. But if really an item cheat is used, the item cheat counter goes >4 in a race.
  • Instant drift is detected. A relative rate is used as trigger to avoid false positives.
  • Moving around before race start is detected.
  • Enabling an item before race start is detected.
  • Manipulation of finish time is detected.

With v1.13, the GPCM server send extra message to inform the cleint about room players and their status. mkw-ana extract these infos and creates a room table. But the new room status is not used at the frontend yet and only available at by beackend comamnd »WIIMMFI«. Try »WATCH WIIMMFI«.

Change log

mkw-ana v1.15 r2787 - 2017-08-21

 - Backend command »WIIMMFI« improved. Try »WATCH WIIMMFI«.

 - \wiimmfi\: New data about inactive clients scanned and used.

 - New frontend command: BACKEND:
   The frontend works like an interactive backend connection. (EXPERIMENTAL)

 - Different minor updates.

 - Windows only: Cygwin update to v2.8.1, 2017-07-03.


mkw-ana v1.14 r2631 - 2016-12-08

 - Detection of GPCM \wiimmfi\...\final\ packets.
    - The statistics table is only available at the backend yet.
    - Update of peer-connection flags.

 - Bug fix: Command FLOWRATES failed sometimes.

 - Bug fix: Better detection of invalid STATUS packages. A warning is printed.

 - New option: --warn-mode=LIST: Define, which warnings are enabled:
    - LENGTH  :  Racing records with wrong length.
    - XLENGTH :  Like RACE but be more verbose.
    - STATUS  :  Invalid STATUS records.
    - EVENT   :  Unknown event found.
    - DEFAULT := LENGTH | XLENGTH | STATUS
    - ALL and NONE are also possible.

 - Command SILENT is now silent again. It also disables all warnings.

→ old logs


General Description

The tool started as simple hex dumper reading network dumps in PCAP format. In the first phase of the tool, the textual dumps of wireshark and tcpdump were much better. But after only a few days, the tool learned to handle records, clients, users, friend codes and Miis. From this moment the tool was better to analyze the Mario Kart Wii traffic.

Now, mkw-ana split the traffic into records and scans some data to detect stages of the online meetings. Stages are for example room, prepare race, count down, racing and end of race. It is able to separate races into events (grand prix and team grand prix) and to calculate racing tables. Racing data can also be exported to support live statistics.

At the moment there are four different kinds of hexdumps. All 4 are able to dump in one line mode to have large tables. Tool less is here a very good tool for vertical and horizontal scrolling. The stages are includes into the dump as comment lines. The dumped records can be filters by sending, receiving, proxy, record types, stage types and packet length. It is also possible to select the dumped bytes by indices and ranges.

With beginning of version 1.02, Wiimm used the knowledge of the Wiimmfi development to re-implement record and stage detection. For example: If you enter a game in visitor modus, then mkw-ana shows racing data before you can see anything of the race on the screen.

Since version 1.06, mkw-ana has a built-in backend server. The user can login with any telnet client and can e.g. reconfigure the table layout or request tables of old races or control the autoban system.

Download

You can find the latest and some old distributions here
Content
  • Binaries for:
    • Linux i386
    • Linux x86_64
    • Cygwin/Windows (Needed Cygwin[1] DLL files are delivered. Best is to install a Cygwin system).
  • Some scripts as examples.
  • Some BMG text examples.
  • Some doc files.
Sometimes I upload single tool updates (beta versions) for testers

Capture the network data

First you must capture the network traffic of the Wii. Therefore you must redirect it to a PC running a capture software. There are 3 general ways to to this:

  • If you have a manageable switch, enable port mirroring and send all Wii traffic to a PC.
  • Use your PC as router.
  • Use old network hubs (not switches). A hub will mirror all traffic of all ports to all others; it's just a multi port repeater and will slow down your network.

Use a software like tcpdump or wireshark to capture the data. Best is to save the captured data directly to a file or to send it to other commands like mkw-ana for a live analysis.

It's also possible to save the data to a file and to make a live analysis at the same time. Use the following command pipe: 

tcpdump -w- -U -i eth1 host wii | tee save.dump | mkw-ana ...

It is important to filter the data by host ip_or_name, because foreign traffic interfere the wii traffic analysis and will have curious side effects.

If using wireshark, save the dump to a file and use the following command for a live analysis: 

mkw-ana COMMAND --follow DUMPFILE ...

DUMPFILE can not only be a standard file, it can also be a socket or a ZCP7IP connection.

See »Dumping Network Traffic« more more details.

Accepted file formats

mkw-ana accepts the following file formats for the network dumps:

  • PCAP 2.4 : Standard packet capturing file format[2].
    • Big and little endian are supported.
    • Timestamps in micro- and in nanoseconds are supported.
  • PCAP 2.4.modified : Like PCAP, but with an extend packet header. This format is used by several routers, AVM FRITZ!Box[3] is one example.
    • Big and little endian are supported.
    • Only microseconds timestamps are supported.
  • PCAP-NG 2.4.modified : A next generation (NG) PCAP format[4].
    • Big and little endian are supported.
    • Microseconds timestamps are assumed, other are not supported.
    • Only the Enhanced Packet Block[5] is supported to retrieve packets.
  • BZIP2 compression
    • mkw-ana detects a BZIP2 compression automatically. It is supported for all other dump file formats.

mkw-ana accepts any list of dump files. The file format is detected for each single input file, so mixed formats are possible. The special file name »-« (minus sign) means: Don't open the file and and read the standard input (stdin) instead. So one of the input files can be read via pipe.

Live Statistics

mkw-ana can scan the network traffic in real time print a complete race statistics and more at the text screen. Moreover it can create makedoc or php data files after each race to create.

First, you must capture the network traffic like described above. Then use one of the commands: 

... | mkw-ana race
mkw-ana race --follow DUMPFILE

With this command you'll see information about selected the track, entering the room and a live game statistics. Important infos about cheats and glitches are added if detected.

Links

References

  1. ↑ Cygwin, a Linux like environment for Windows.
  2. ↑ Wireshark: LIBPCAP file format
  3. ↑ AVM FRITZ!Box, a widely used router in Germany
  4. ↑ Wincap: The next generation PCAP file format
  5. ↑ Wincap: PCAP-NG, Enhanced Packet Block
Network Protocol

Information:
Nintendo's Servers – Friend Code – Nick – Dumping Network Traffic

Record Types:
HEADER – ROOM – SELECT – USER
RACEHEADER_1 – RACEHEADER_2 – RACEDATA – ITEM – EVENT
NATNEG – ANNOUNCE – QUIT – STATUS – PARAM-STRING

Wiimmfi Extensions:
Online Status – Connection Status – Wiimmfi packets – Server SV

Software:
Wiimms mkw-ana

Retrieved from "https://wiki.tockdom.com/w/index.php?title=Wiimms_mkw-ana_(tool)&oldid=394178"