Difference between revisions of "Nintendo Video"

From 3dbrew
Jump to navigation Jump to search
m (→‎Metadata: The metadata length is fixed)
 
(18 intermediate revisions by 4 users not shown)
Line 1: Line 1:
−
'''Nintendo Video''' is a service allowing owners of American, Japanese, and European 3DSes to download and watch various videos offered by Nintendo. Nintendo Video uses SpotPass to download videos even when the Nintendo Video app itself is not running.
+
'''Nintendo Video''' is a service allowing owners of American, Japanese, and European 3DS's to download and watch various videos offered by Nintendo. Nintendo Video uses SpotPass to download videos, even when the Nintendo Video app itself is not running. Nintendo Video was discontinued March 31, 2014.
−
 
+
−
'''Eurosport''' is a service similar to '''Nintendo Video''' and allowing owners of European 3DSes to download and watch various videos offered by Eurosport.  
+
'''Eurosport''' is a service similar to '''Nintendo Video''' and allowing owners of European 3DS's to download and watch various videos offered by Eurosport. Eurosport was discontinued December 31, 2012.
  
 
== Internet connection ==
 
== Internet connection ==
  
−
To identify your 3DS's region and country, different URLs are requested by 3DS's from different countries. A URL contains a subdomain that's specific for your region (EU/USA/JP), a country code that's specific to your country and a language code. Here's a table containing country codes and subdomains known so far and corresponding file names:
+
To identify your 3DS's region and country, different URLs are requested by 3DS's from different countries. A URL contains a subdomain that's specific for your region (EU/USA/JP), a country code that's specific to your country, and a language code. Here's a table containing country codes and subdomains known so far and their corresponding file names:
  
 
{| class="wikitable"
 
{| class="wikitable"
Line 78: Line 78:
 
In all requests below, ''COUNTRYCODE'' should be replaced with your country's code, ''COUNTRYSUBDOMAIN'' should be replaced with your region's subdomain. ''FILENAME'' are also depends on the region and should be replaced correspondingly. ''LANGUAGECODE'' should be replaced by a desired language (by now most of the content are the same for all available languages, so one can use "1" as a most common).
 
In all requests below, ''COUNTRYCODE'' should be replaced with your country's code, ''COUNTRYSUBDOMAIN'' should be replaced with your region's subdomain. ''FILENAME'' are also depends on the region and should be replaced correspondingly. ''LANGUAGECODE'' should be replaced by a desired language (by now most of the content are the same for all available languages, so one can use "1" as a most common).
  
−
Surprisingly, Nintendo Video uses plain unencrypted HTTP connection to transfer videos. When "Connectivity check" button is pressed, Nintendo Video sends a following HTTP request to ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net:
+
Surprisingly, Nintendo Video uses plain unencrypted HTTP connection to transfer videos. When "connectivity check" button is pressed, Nintendo Video sends a following HTTP request to ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net:
  
 
<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/CHECK HTTP/1.1
 
<tt>GET /1/''COUNTRYCODE''/''LANGUAGECODE''/CHECK HTTP/1.1
Line 108: Line 108:
 
Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt>
 
Host: ''COUNTRYSUBDOMAIN''.est.c.app.nintendowifi.net</tt>
  
−
''FILENAMEi'' seems to return 403 if user's region doesn't match, 404 if ''i''th video doesn't exist and the video itself otherwise. As of 18th of July 2011, only 1st and 2nd videos are available from UK IP addresses.
+
''FILENAME'' seems to return a 403 error if the user's region doesn't match, 404 if the video doesn't exist and the video itself otherwise. As of July 18th, 2011, only 1st and 2nd videos are available from UK IP addresses.
  
 
For Japan region /1/1/0/ESJ_CNF must also present on a server in order to play video files.
 
For Japan region /1/1/0/ESJ_CNF must also present on a server in order to play video files.
Line 115: Line 115:
  
 
== SD storage ==
 
== SD storage ==
−
After downloading videos, Nintendo Video stores them on the SD card. Videos with the decrypted SpotPass payload are stored in [[Extdata]]. Region/country info is presumably stored in this metadata.
+
Downloaded videos are stored in the SD card [[Extdata]], from the decrypted [[SpotPass]] content payload, adding an additional header to them. Country info is presumably stored in this metadata, region-lock is handled by the BOSS module via the programID in the [[SpotPass#Payload Content Header|payload header]].
  
−
All of these fields are big-endian?
+
While the SpotPass payload uses little-endian, the extra header added to the Extdata is stored in big-endian.
−
Structure of the metadata:
 
 
{| class="wikitable"
 
{| class="wikitable"
 
|-
 
|-
Line 126: Line 125:
 
|-
 
|-
 
| 0x0
 
| 0x0
−
| 4
+
| 0x4
 
| Unknown, value is 0x18
 
| Unknown, value is 0x18
 
|-
 
|-
Line 134: Line 133:
 
|-
 
|-
 
| 0x18
 
| 0x18
−
| 8
+
| 0x8
 
| TitleID of Nintendo Video
 
| TitleID of Nintendo Video
 
|-
 
|-
Line 143: Line 142:
 
| 0x28
 
| 0x28
 
| 0x4
 
| 0x4
−
| Total filesize?
+
| File size
 +
|-
 +
| 0x2C
 +
| 0x4
 +
| ?
 +
|-
 +
| 0x30
 +
| 0x4
 +
| Release date (integer, YYYYmmddhh)
 +
|-
 +
| 0x34
 +
|
 +
| SpotPass payload
 +
|}
 +
 
 +
== File format ==
 +
The SpotPass content downloaded for Nintendo Video uses the [[SpotPass]] content container format, see the SpotPass page for info on the container format. At the end of the video file is a JPEG, which contains the video thumbnail, and various advertising metadata (interactive links) including the URL associated with the video. The text shown on the web browser button is also stored in the interactive links.
 +
 
 +
Region info is stored in the decrypted SpotPass crypto layer, see above SD section.
 +
 
 +
The following entries use little-endian.
 +
 
 +
=== Header ===
 +
{| class="wikitable"
 +
|-
 +
! Offset
 +
! Length
 +
! Notes
 +
|-
 +
| 0x0
 +
| 0x4
 +
| Start address of header? (0x0)
 
|-
 
|-
−
| 0x2c
+
| 0x4
−
| 0x2c
+
| 0x4
−
| Unknown, some countries' videos has two extra words added here?
+
| End address of header
 
|-
 
|-
−
| 0x58
+
| 0x8
 +
| 0x4
 +
| Start address of metadata and video
 +
|-
 +
| 0xC
 +
| 0x4
 +
| End address of metadata and video
 +
|-
 +
| 0x10
 +
| 0x4
 +
| Video thumbnail length
 +
|-
 +
| 0x14
 +
| 0x4
 +
| Unknown (padding?)
 +
|-
 +
| 0x18
 +
|
 +
| [[#Interactive links header|Interactive links header]]
 +
|-
 +
|
 +
|
 +
| [[#Metadata|Metadata]]
 +
|}
 +
 
 +
=== Metadata ===
 +
{| class="wikitable"
 +
|-
 +
! Offset
 +
! Length
 +
! Notes
 +
|-
 +
| 0x0
 +
| 0x4
 +
| Metadata length (0x248)
 +
|-
 +
| 0x4
 
| 0x20
 
| 0x20
−
| ASCII Video ID? M<shortvidtitle>someid
+
| Video ID (M<shortvidtitle>video ID)
 
|-
 
|-
−
| 0x68
+
| 0x24
−
| 0x20
+
| 0x8
−
| ?
+
| [[#Timestamp|Release date]]
 +
|-
 +
| 0x2C
 +
| 0x8
 +
| [[#Timestamp|Expire date]]
 
|-
 
|-
−
| 0x88
+
| 0x34
 
| 0x78
 
| 0x78
 
| UTF-16 video title
 
| UTF-16 video title
 
|-
 
|-
−
| 0x100
+
| 0xAC
−
| 0xc
+
| 0x8
 
| ?
 
| ?
 
|-
 
|-
−
| 0x10c
+
| 0xB4
 +
| 0x4
 +
| Video length
 +
|-
 +
| 0xB8
 
| 0x190
 
| 0x190
 
| UTF-16 video description
 
| UTF-16 video description
 
|-
 
|-
−
| 0x29c
+
| 0x248
−
| 0x20
+
| 0x20 * number of links
−
| Another ASCII video ID? I<shortvidtitle>someid
+
| Interactive link IDs (I<shortvidtitle>video ID)
 +
|-
 +
|
 +
| Video size
 +
| Mobiclip .moflex video data (first word here is little-endian magic number 0xABAA324C)
 
|-
 
|-
−
| 0x2bc
+
|  
−
| 0xd44
+
| Thumbnail size
−
| ?
+
| Video thumbnail
 
|-
 
|-
−
| 0x1000
+
|  
−
| ?
+
| Interactive links data size
−
| Icon data might be stored here?
+
| [[#Interactive links data|Interactive links data]]
 
|}
 
|}
  
−
== File format ==
+
=== Timestamp ===
 +
The release and expire date are stored using a custom timestamp, where each value (year, month, day...) is stored as unique bytes.
 +
 
 +
{| class="wikitable"
 +
|-
 +
! Offset
 +
! Length
 +
! Notes
 +
|-
 +
| 0x0
 +
| 0x2
 +
| Year
 +
|-
 +
| 0x2
 +
| 0x1
 +
| Month
 +
|-
 +
| 0x3
 +
| 0x1
 +
| Day
 +
|-
 +
| 0x4
 +
| 0x1
 +
| Hours
 +
|-
 +
| 0x5
 +
| 0x1
 +
| Minutes
 +
|-
 +
| 0x6
 +
| 0x1
 +
| Seconds
 +
|-
 +
| 0x7
 +
| 0x1
 +
| Padding?
 +
|}
  
−
File format used for storing videos is not yet known either. Both videos that were available at 18th of July 2011 contained string "boss" in the first four bytes, which leads me to believe this is a [http://en.wikipedia.org/wiki/Magic_number_(programming)#Magic_numbers_in_files "magic number"] used to identify this type of file. This header and the crypto used for the payload following it is presumably the [[SpotPass]] content encapsulation format.
+
=== Interactive links ===
 +
Interactive links are structures that store the advertising and thumbnail data that is displayed to the user during the video playback.
  
 +
==== Interactive links header ====
 
{| class="wikitable"
 
{| class="wikitable"
 
|-
 
|-
 
! Offset
 
! Offset
 
! Length
 
! Length
−
!  
+
! Notes
 
|-
 
|-
 
| 0x0
 
| 0x0
 
| 0x4
 
| 0x4
−
| "boss"
+
| Number of interactive links
 
|-
 
|-
 
| 0x4
 
| 0x4
 
| 0x4
 
| 0x4
−
| Always 00 01 00 01
+
| Address of interactive link data
 
|-
 
|-
 
| 0x8
 
| 0x8
 +
|
 +
| Address of additional interactive links data
 +
|}
 +
 +
==== Interactive links data ====
 +
Interactive links store a thumbnail image as a JPEG image.
 +
 +
{| class="wikitable"
 +
|-
 +
! Offset
 +
! Length
 +
! Notes
 +
|-
 +
| 0x0
 
| 0x4
 
| 0x4
−
| Big-endian filesize
+
| Metadata length (0x16C)
 
|-
 
|-
−
| 0xC
 
 
| 0x4
 
| 0x4
−
| Always 00 00 00 00
+
| 0x30
 +
| Interactive link ID (I<shortvidtitle>video ID)
 
|-
 
|-
−
| 0x10
+
| 0x34
 +
| 0x8
 +
| Unknown
 +
|-
 +
| 0x3C
 +
| 0x100
 +
| URL address of link. For eShop link, use (tiger://<TitleID>)
 +
|-
 +
| 0x13C
 
| 0x4
 
| 0x4
−
| Release date (UNIX timestamp)
+
| Button link color (RGBA)
 
|-
 
|-
−
| 0x14
+
| 0x140
−
| 0x8
+
| 0x28
−
| Always 00 01 00 00 00 02 00 02
+
| UTF-16 button link text
 +
|-
 +
| 0x168
 +
| 0x4
 +
| Thumbnail length
 
|-
 
|-
−
| 0x1c
+
|  
−
| 0x27a?
+
| Thumbnail size
−
| Unknown, going by the size of this a RSA-4096 signature might be stored here among other things?
+
| Thumbnail image
 
|}
 
|}
−
 
−
It appears that this file format is big-endian, unlike [[CXI]].
 
−
 
−
Data following the header is encrypted, the CTR used is likely based on metadata in the header.(like the timestamp) The video codec used is unknown. Region info is stored in the decrypted SpotPass crypto layer, see above SD section.
 
  
 
== Server spoofing ==  
 
== Server spoofing ==  
Line 235: Line 373:
 
# ???
 
# ???
 
# PROFIT!
 
# PROFIT!
 +
 +
This can be done with any DNS server and HTTP server, as long as you spoof everything correctly. It is possible on Windows. I have not tried Mac OS X.
 +
 +
Unfortunately, this currently has little use since Nintendo shut the services down. However, they can still be spoofed if you have everything still on your 3DS. Spoofing your own videos could be possible, but you can already watch videos with the web browser and something like Universal Media Server.
  
 
== External links ==
 
== External links ==
 
* [http://www.youtube.com/watch?v=Tl8QYofL1tg A video showing Nintendo Video server being spoofed]
 
* [http://www.youtube.com/watch?v=Tl8QYofL1tg A video showing Nintendo Video server being spoofed]

Latest revision as of 13:31, 21 February 2023

Nintendo Video is a service allowing owners of American, Japanese, and European 3DS's to download and watch various videos offered by Nintendo. Nintendo Video uses SpotPass to download videos, even when the Nintendo Video app itself is not running. Nintendo Video was discontinued March 31, 2014.

Eurosport is a service similar to Nintendo Video and allowing owners of European 3DS's to download and watch various videos offered by Eurosport. Eurosport was discontinued December 31, 2012.

Internet connection[edit]

To identify your 3DS's region and country, different URLs are requested by 3DS's from different countries. A URL contains a subdomain that's specific for your region (EU/USA/JP), a country code that's specific to your country, and a language code. Here's a table containing country codes and subdomains known so far and their corresponding file names:

Country Region subdomain File name
EUR (Nintendo Video) pubeu-p ESP_MD
EUR (Eurosport) pubes-p EWP_MD
USA pubus-p ESE_MD
Japan pubjp-p ESJ_MD

See http://www.wiibrew.org/wiki/Country_Codes for the country codes.

Language codes known so far:

Language Code Region
Japanese 0 Japan
English 1 EUR/USA
French 2 EUR/USA
German 3 EUR
Italian 4 EUR
Spanish 5 EUR/USA
Netherlands 8 EUR
Portuguese 9 EUR/USA
Russian 10 EUR

In all requests below, COUNTRYCODE should be replaced with your country's code, COUNTRYSUBDOMAIN should be replaced with your region's subdomain. FILENAME are also depends on the region and should be replaced correspondingly. LANGUAGECODE should be replaced by a desired language (by now most of the content are the same for all available languages, so one can use "1" as a most common).

Surprisingly, Nintendo Video uses plain unencrypted HTTP connection to transfer videos. When "connectivity check" button is pressed, Nintendo Video sends a following HTTP request to COUNTRYSUBDOMAIN.est.c.app.nintendowifi.net:

GET /1/COUNTRYCODE/LANGUAGECODE/CHECK HTTP/1.1

Host: COUNTRYSUBDOMAIN.est.c.app.nintendowifi.net

As you can see, no console-specific data is being sent. The server responds with either a 403 or 404 error code, where 403 means that user's region (determined by IP, I guess) doesn't match the region specified by COUNTRYCODE and COUNTRYSUBDOMAIN and 404 means that everything's OK.

If everything is OK with the region check, the 3DS proceeds to download videos. It seems that support for only four videos is hardcoded into Nintendo Video app, because it makes following requests (to the same server as the CHECK query):


GET /1/COUNTRYCODE/LANGUAGECODE/FILENAME1 HTTP/1.1

Host: COUNTRYSUBDOMAIN.est.c.app.nintendowifi.net


GET /1/COUNTRYCODE/LANGUAGECODE/FILENAME2 HTTP/1.1

Host: COUNTRYSUBDOMAIN.est.c.app.nintendowifi.net


GET /1/COUNTRYCODE/LANGUAGECODE/FILENAME3 HTTP/1.1

Host: COUNTRYSUBDOMAIN.est.c.app.nintendowifi.net


GET /1/COUNTRYCODE/LANGUAGECODE/FILENAME4 HTTP/1.1

Host: COUNTRYSUBDOMAIN.est.c.app.nintendowifi.net

FILENAME seems to return a 403 error if the user's region doesn't match, 404 if the video doesn't exist and the video itself otherwise. As of July 18th, 2011, only 1st and 2nd videos are available from UK IP addresses.

For Japan region /1/1/0/ESJ_CNF must also present on a server in order to play video files.

These videos can easily be downloaded from any computer with IP address that matches country specified by COUNTRYCODE, COUNTRYSUBDOMAIN and LANGUAGECODE using wget without any special settings. Videos are region-locked.

SD storage[edit]

Downloaded videos are stored in the SD card Extdata, from the decrypted SpotPass content payload, adding an additional header to them. Country info is presumably stored in this metadata, region-lock is handled by the BOSS module via the programID in the payload header.

While the SpotPass payload uses little-endian, the extra header added to the Extdata is stored in big-endian.

Offset Length Notes
0x0 0x4 Unknown, value is 0x18
0x4 0x14 ?
0x18 0x8 TitleID of Nintendo Video
0x20 0x8 ?
0x28 0x4 File size
0x2C 0x4 ?
0x30 0x4 Release date (integer, YYYYmmddhh)
0x34 SpotPass payload

File format[edit]

The SpotPass content downloaded for Nintendo Video uses the SpotPass content container format, see the SpotPass page for info on the container format. At the end of the video file is a JPEG, which contains the video thumbnail, and various advertising metadata (interactive links) including the URL associated with the video. The text shown on the web browser button is also stored in the interactive links.

Region info is stored in the decrypted SpotPass crypto layer, see above SD section.

The following entries use little-endian.

Header[edit]

Offset Length Notes
0x0 0x4 Start address of header? (0x0)
0x4 0x4 End address of header
0x8 0x4 Start address of metadata and video
0xC 0x4 End address of metadata and video
0x10 0x4 Video thumbnail length
0x14 0x4 Unknown (padding?)
0x18 Interactive links header
Metadata

Metadata[edit]

Offset Length Notes
0x0 0x4 Metadata length (0x248)
0x4 0x20 Video ID (M<shortvidtitle>video ID)
0x24 0x8 Release date
0x2C 0x8 Expire date
0x34 0x78 UTF-16 video title
0xAC 0x8 ?
0xB4 0x4 Video length
0xB8 0x190 UTF-16 video description
0x248 0x20 * number of links Interactive link IDs (I<shortvidtitle>video ID)
Video size Mobiclip .moflex video data (first word here is little-endian magic number 0xABAA324C)
Thumbnail size Video thumbnail
Interactive links data size Interactive links data

Timestamp[edit]

The release and expire date are stored using a custom timestamp, where each value (year, month, day...) is stored as unique bytes.

Offset Length Notes
0x0 0x2 Year
0x2 0x1 Month
0x3 0x1 Day
0x4 0x1 Hours
0x5 0x1 Minutes
0x6 0x1 Seconds
0x7 0x1 Padding?

Interactive links[edit]

Interactive links are structures that store the advertising and thumbnail data that is displayed to the user during the video playback.

Interactive links header[edit]

Offset Length Notes
0x0 0x4 Number of interactive links
0x4 0x4 Address of interactive link data
0x8 Address of additional interactive links data

Interactive links data[edit]

Interactive links store a thumbnail image as a JPEG image.

Offset Length Notes
0x0 0x4 Metadata length (0x16C)
0x4 0x30 Interactive link ID (I<shortvidtitle>video ID)
0x34 0x8 Unknown
0x3C 0x100 URL address of link. For eShop link, use (tiger://<TitleID>)
0x13C 0x4 Button link color (RGBA)
0x140 0x28 UTF-16 button link text
0x168 0x4 Thumbnail length
Thumbnail size Thumbnail image

Server spoofing[edit]

In case you want to try messing with Nintendo Video, here's a description of what I did:

  1. Set up a DNS server using bind9, which returned my IP as the IP for pubeu-p.est.c.app.nintendowifi.net (bind config).
    1. Don't forget to replace MY_IP in config with your IP address, but don't replace the IP of conntest.nintendowifi.net service
  2. Set up an HTTP server using nginx and put ESP_MD1, ESP_MD2 (which I have downloaded from Nintendo's servers earlier, see above) in my /var/www/1/110/1/ folder.
  3. Configured my 3DS to use my DNS server as both primary and secondary DNS server.
  4. ???
  5. PROFIT!

This can be done with any DNS server and HTTP server, as long as you spoof everything correctly. It is possible on Windows. I have not tried Mac OS X.

Unfortunately, this currently has little use since Nintendo shut the services down. However, they can still be spoofed if you have everything still on your 3DS. Spoofing your own videos could be possible, but you can already watch videos with the web browser and something like Universal Media Server.

External links[edit]

Retrieved from "https://www.3dbrew.org/w/index.php?title=Nintendo_Video&oldid=22074"