Nintendo Video

Attention: What's described here was found out by reverse-engineering Nintendo Video on a European 3DS and might not apply to Japanese Nintendo Video service.

Nintendo Video is a service allowing owners of American, Japanese, and European 3DSes to download and watch various videos offered by Nintendo. Nintendo Video uses SpotPass to download videos even when the Nintendo Video app itself is not running.

Internet connection

To identify your 3DS's region and country, different URLs are requested by 3DS's from different countries. A URL contains a subdomain that's specific for your region (EU/USA/JP), a country code that's specific to your country and a language code. Here's a table containing country codes and subdomains known so far and corresponding file names:

Country	Region subdomain	File name
EUR	pubeu-p	ESP_MD
USA	pubus-p	ESE_MD
Japan	pubjp-p	ESJ_MD

See http://www.wiibrew.org/wiki/Country_Codes for the country codes.

Language codes known so far:

Language	Code	Region
Japanese	0	Japan
English	1	EUR/USA
French	2	EUR/USA
German	3	EUR
Italian	4	EUR
Spanish	5	EUR/USA
Netherlands	8	EUR
Portuguese	9	EUR/USA
Russian	10	EUR

In all requests below, COUNTRYCODE should be replaced with your country's code, COUNTRYSUBDOMAIN should be replaced with your region's subdomain. FILENAME are also depends on the region and should be replaced correspondingly. LANGUAGECODE should be replaced by a desired language (by now most of the content are the same for all available languages, so one can use "1" as a most common).

Surprisingly, Nintendo Video uses plain unencrypted HTTP connection to transfer videos. When "Connectivity check" button is pressed, Nintendo Video sends a following HTTP request to COUNTRYSUBDOMAIN.est.c.app.nintendowifi.net:

GET /1/COUNTRYCODE/LANGUAGECODE/CHECK HTTP/1.1

Host: COUNTRYSUBDOMAIN.est.c.app.nintendowifi.net

As you can see, no console-specific data is being sent. The server responds with either a 403 or 404 error code, where 403 means that user's region (determined by IP, I guess) doesn't match the region specified by COUNTRYCODE and COUNTRYSUBDOMAIN and 404 means that everything's OK.

If everything is OK with the region check, the 3DS proceeds to download videos. It seems that support for only four videos is hardcoded into Nintendo Video app, because it makes following requests (to the same server as the CHECK query):

GET /1/COUNTRYCODE/LANGUAGECODE/FILENAME1 HTTP/1.1

Host: COUNTRYSUBDOMAIN.est.c.app.nintendowifi.net

GET /1/COUNTRYCODE/LANGUAGECODE/FILENAME2 HTTP/1.1

Host: COUNTRYSUBDOMAIN.est.c.app.nintendowifi.net

GET /1/COUNTRYCODE/LANGUAGECODE/FILENAME3 HTTP/1.1

Host: COUNTRYSUBDOMAIN.est.c.app.nintendowifi.net

GET /1/COUNTRYCODE/LANGUAGECODE/FILENAME4 HTTP/1.1

Host: COUNTRYSUBDOMAIN.est.c.app.nintendowifi.net

FILENAMEi seems to return 403 if user's region doesn't match, 404 if ith video doesn't exist and the video itself otherwise. As of 18th of July 2011, only 1st and 2nd videos are available from UK IP addresses.

For Japan region /1/1/0/ESJ_CNF must also present on a server in order to play video files.

These videos can easily be downloaded from any computer with IP address that matches country specified by COUNTRYCODE, COUNTRYSUBDOMAIN and LANGUAGECODE using wget without any special settings. Videos are region-locked.

SD storage

After downloading videos, Nintendo Video stores them on the SD card. Videos with the decrypted SpotPass payload are stored in Extdata. Metadata is stored in cleartext in the decrypted extdata - the actual video might be encrypted(unknown), there's no magic number/fourcc in the decrypted extdata for the video. Region/country info is presumably stored in this metadata.

Structure of the above metadata:(size is 0x1000-bytes)

Offset	Length	Notes
0x0	4	Unknown, value is 0x18
0x4	0x14	?
0x18	8	Big-endian titleID of Nintendo Video
0x20	0x38	Unknown, some countries' videos has two extra words added here?
0x58	0x20	ASCII Video ID? M<shortvidtitle>someid
0x68	0x20	?
0x88	0x78	UCS-2 video title
0x100	0xc	?
0x10c	0x190	UCS-2 video description
0x29c	0x20	Another ASCII video ID? I<shortvidtitle>someid
0x2bc	0xd44	?

File format

File format used for storing videos is not yet known either. Both videos that were available at 18th of July 2011 contained string "boss" in the first four bytes, which leads me to believe this is a "magic number" used to identify this type of file. This header and the crypto used for the payload following it is presumably the SpotPass content encapsulation format.

Offset	Length
0x0	0x4	"boss"
0x4	0x4	Always 00 01 00 01
0x8	0x4	Big-endian filesize
0xC	0x4	Always 00 00 00 00
0x10	0x4	Release date (UNIX timestamp)
0x14	0x8	Always 00 01 00 00 00 02 00 02

It appears that this file format is big-endian, unlike CXI.

Data following the header is encrypted, the CTR used is likely based on metadata in the header.(like the timestamp) Since WC24 content was signed, it's likely SpotPass content is signed as well. The video codec used is unknown. Region info is stored the decrypted SpotPass crypto layer, see above SD section.

Server spoofing

In case you want to try messing with Nintendo Video, here's a description of what I did:

1. Set up a DNS server using bind9, which returned my IP as the IP for pubeu-p.est.c.app.nintendowifi.net (bind config).
   1. Don't forget to replace MY_IP in config with your IP address, but don't replace the IP of conntest.nintendowifi.net service
2. Set up an HTTP server using nginx and put ESP_MD1, ESP_MD2 (which I have downloaded from Nintendo's servers earlier, see above) in my /var/www/1/110/1/ folder.
3. Configured my 3DS to use my DNS server as both primary and secondary DNS server.
4. ???
5. PROFIT!

External links

• A video showing Nintendo Video server being spoofed