Jump to content
This Topic

Pkx: The New Pokemon Format For Gen 6

Bond697

By Bond697
in PKM

 Share

Recommended Posts

Surgo

Surgo

Posted
Posted
  Keplar said:
So you're having trouble using a virtual adapter to broadcast? I was actually considering switching over to that, in favor of a pure software solution that didn't require an extra router.

At the moment, I'm searching for a program that I can easily tweak to swap out sections of packets. It would be nice if this involved HTTP traffic or if there was a simple DNS address I could spoof... It sure would make things a lot easier. UDP modification is relatively new to me.

If you're a Linux user, this is fairly easy and straightforward to do using Netfilter. Packets can be stolen from the kernel using a standard iptables rule, which are then modified by a userspace program that you write and then reinjected back into the network stack.

  • Replies 284
  • Created
  • Last Reply

Top Posters In This Topic

Popular Days

Top Posters In This Topic

Popular Days

phoenragon

phoenragon

Posted
Posted
  xyzman said:
What .NET framework version is required? I don't have access to Windows machine, and WINE + .NET was always a gamble...

WINE and Wineskin aren't compatible with NET framework 4 at all as far as I know. But from the sound of Codemonkey's post, it may not take much to compile a Mac friendly version:

  codemonkey85 said:
Pretty sure it's 4.0. The backend library is vanilla C++ so I could compile a version for Linux / Mac if people need it.

That would be much appreciated, codemonkey, if you have the time. Would like to be able to help in some way if possible.

er1c1996

er1c1996

Posted
Posted

Codemonkey, idk if you're planning on adding move/ability names once they are confirmed but I can confirm that after intercepting my Eevee that moves 39 = Tail Whip, 204 = Charm, 281 = Yawn, and 273 = Wish. Basically the same as previous gens.

er1c1996

er1c1996

Posted
Posted
  codemonkey85 said:
The move IDs of moves from previous generations are most likely all the same index numbers as in previous generations (they have been so far anyway). For reference: http://bulbapedia.bulbagarden.net/wiki/List_of_moves

However, if you wish to contribute index numbers for new moves, by all means...

I figured as much, just basically confirming it. Problem is you have to Wonder Trade to do this, and I'm not sure if there's a time at which I can receive the packet but not actually trade the Pokemon. If I can figure that out, I'd surely get a few new moves out there.

Otherwise, it's a lot of breeding.

EDIT: If anyone's intersted, here's my Eevee's .pkx. https://www.dropbox.com/s/7jtv2isp4blucf8/eevee.pkx I don't know, might be useful for something.

bluesun

bluesun

Posted
Posted

I'm surprised they kept the same encryption method for the Pokemon data, to be honest...

Partial list of new items:

#639/0x27F, Weakness Policy

#640/0x280, Assault Vest

#644/0x284, Pixie Plate

#645/0x285, Ability Capsule

#646/0x286, Whipped Dream

#647/0x287, Sachet

#648/0x288, Luminous Moss

#649/0x289, Snowball

#650/0x28A, Safety Goggles

#652/0x28C, Rich Mulch

#653/0x28D, Surprise Mulch

#654/0x28E, Boost Mulch

#655/0x28F, Amaze Mulch

#686/0x2AE, Roseli Berry

#687/0x2AF, Kee Berry

#688/0x2B0, Maranga Berry

#699/0x2BB, Discount Coupon

#704/0x2C0, Strange Souvenir

#708/0x2C4, Lumiose Galette

#709/0x2C5, unknown normal item, some sort of wooden tablet

#710/0x2C6, Jaw Fossil

#711/0x2C7, Sail Fossil

#715/0x2CB, Fairy Gem

656~685 are likely the Mega Stones, if anyone wants to poke around. 28 Mega Stones are known, so there may be two more undiscovered in that gap (and it's easier to poke around 30 items than attempt to form+1 all 700+ Pokemon).

If all the item slots are used, there's around 11 or so items still not known, so they may be worth checking out.

evandixon

evandixon

Posted
Posted
  theSLAYER said:
While this post is completely not helping to contribute (I'll like to, but I don't have the hardware to help as of now),

Has anyone tried to capture packets for mystery gifts?

At least you're not asking "whens pokgen being updated??????????" or something.

Now to add something to this post so it's not completely off-topic, what's the "sanity placeholder" on the wiki page? It looks like empty space, but does it have a purpose?

codemonkey85

codemonkey85

Posted
Posted
  evandixon said:
Now to add something to this post so it's not completely off-topic, what's the "sanity placeholder" on the wiki page? It looks like empty space, but does it have a purpose?

If you're referring to 0x04 - 0x05, I believe those were runtime flags in the previous games that indicated whether or not data was encrypted. One was for box data and one was for party data.

Kane49

Kane49

Posted
Posted (edited)

Yo guys !

Im new here as you can probably see :P Im fiddling about with stuff and hope its not to imposing to ask the following question:

So here is my wondertrade packet, data section starts at 0x0057, and i can't seem to find where the pokemon data starts.

Im pretty sure that if i find it once (with help) i will find it on my own later so any help finding it would be appreciated :)

  Reveal hidden contents

And again i hope this isn't too imposing, i have some time to kill and the whole system is very interesting programmatically :)

Edited by codemonkey85
Spoiler tags to make life easier
theSLAYER

theSLAYER

Posted
Posted (edited)
  evandixon said:
At least you're not asking "whens pokgen being updated??????????" or something.

I know better than to ask that.

If it's out, it's out. No need to ask, really.

Anyhow, it seems that "Markings" are missing from the structure page.

EDIT:

  Kane49 said:
i can't seem to find where the pokemon data starts.

from 0x94 to 0x17b.

(it's a Pansage belonging to yoyo)

To find it, you'll have to identify the following pattern:

xx xx xx xx 00 xx xx.... xx 00 00 00

The first 00 (I mentioned above) is the "Sanity placeholder" and it'll be seemingly garbled mess till the end, which will be the long cycles of 00 00 00..

The first 4 xx xx xx xx is the PID value.

For simplicity sake, I've attached your encrypted Pansage.

Edited by theSLAYER
Kane49

Kane49

Posted
Posted
  theSLAYER said:

For simplicity sake, I've attached your encrypted Pansage.

Thanks alot man, this helps immensely :)

/Edit:

For everyone else researching this, the pokemon data in wonder trades always start after: 

76 03 00 00[/Code]
 in Hex or for the more visual people
[Code]v   [/Code]
 in Ascii
My sample size is pretty small but it seems to work out :)
/E2: 
Trying to figure out how the server tells my 3DS who to trade with, it exchanges port numbers with one of the servers but the IP doesnt seem to be transmitted :)
I know that when you connect to the nintendo wifi thingy it requests a DHCP Record, maybe there are some hostname shenanigans going on, lets find out !
er1c1996

er1c1996

Posted
Posted (edited)

Has anyone figured out how the GTS packets work? Trading is good and all, but GTS would be a solo job. Here's the data section of what I suspect to be the packet:

  Reveal hidden contents

Most likely it's encrypted via TLS and these packets are useless, but it's worth looking at.

Edited by codemonkey85
Spoiler tags not just for spoilers
kelly087

kelly087

Posted
Posted

The GTS is TLS Encrypted, isn't it? Someone correct me if I'm wrong, but I don't think GTS will be as simple as finding the right 232 bytes from the packet.

Zaneris

Zaneris

Posted
Posted

The only thing I'm missing from getting the Wonder Trade to work is the checksum 16 bytes checksum within the EAD header.

Any ideas?

EAD header:

uint magic; //0x0301D0EA // EA D0 01 03

ushort size; // without EAD header

ushort unk1; // wondertrade: 0x1111, gts = 0xAFA1

ushort unk2; // wondertrade: 0x08E2, gts = 0x00E2

ushort unk3;

ushort packetId;

ubyte checksum[16];

ushort unk4; // 02 01

ubyte encryptedFlag; // 00 = plaintext (wondertrade), 01 = encrypted (gts)

Data:

ubyte data;

if it's wondertrade:

byte unk[0x1C];

byte pkx[0xE8];

Otherwise, the actual injection part is easy.

Bond697

Bond697

Posted
  • Author
Posted (edited)
  evandixon said:
At least you're not asking "whens pokgen being updated??????????" or something.

Now to add something to this post so it's not completely off-topic, what's the "sanity placeholder" on the wiki page? It looks like empty space, but does it have a purpose?

they've been there in every game from gen 3 onward. there's 3 bitflags that are only used in game, so those bytes are always 00 otherwise. the bitflags are:

-pkm is egg

-pkm party data is decrypted

-pkm box data is decrypted

the game uses them to decide whether or not it should encrypt or decrypt data.

  kelly087 said:
The GTS is TLS Encrypted, isn't it? Someone correct me if I'm wrong, but I don't think GTS will be as simple as finding the right 232 bytes from the packet.

yes, it's encrypted somehow.

Edited by Bond697
Codr

Codr

Posted
Posted
  kelly087 said:
The GTS is TLS Encrypted, isn't it? Someone correct me if I'm wrong, but I don't think GTS will be as simple as finding the right 232 bytes from the packet.

Unless the TLS certificate is obtained (and I don't know if that's even enough by itself), nobody is going to be making fake GTS servers. I'm not sure if the GTS itself is encrypted with TLS, but the initial connection to Nintendo servers that the game requires you to go through is.

Kane49

Kane49

Posted
Posted
  Codr said:
Unless the TLS certificate is obtained (and I don't know if that's even enough by itself), nobody is going to be making fake GTS servers. I'm not sure if the GTS itself is encrypted with TLS, but the initial connection to Nintendo servers that the game requires you to go through is.

Nintendos TLS Client Certificate, rename to .der:

nintendocertific&#.txt

nintendocertific.txtFetching info...

Keplar

Keplar

Posted
Posted
  Zaneris said:
The only thing I'm missing from getting the Wonder Trade to work is the checksum 16 bytes checksum within the EAD header.

Any ideas?

EAD header:

uint magic; //0x0301D0EA // EA D0 01 03

ushort size; // without EAD header

ushort unk1; // wondertrade: 0x1111, gts = 0xAFA1

ushort unk2; // wondertrade: 0x08E2, gts = 0x00E2

ushort unk3;

ushort packetId;

ubyte checksum[16];

ushort unk4; // 02 01

ubyte encryptedFlag; // 00 = plaintext (wondertrade), 01 = encrypted (gts)

Data:

ubyte data;

if it's wondertrade:

byte unk[0x1C];

byte pkx[0xE8];

Otherwise, the actual injection part is easy.

16 byte checksum? That sounds more like an MD5 hash, in my opinion. Out of curiosity, I've coded a small script to hash all possible data segments of the packet's payload, and compare these hashes for a possible match. Unfortunately, no hashed data segments of my packet matched. Perhaps a salted MD5 hash is being used?

Codr

Codr

Posted
Posted
  Kane49 said:
Nintendos TLS Client Certificate, rename to .der:

The games have a certificate as well. I won't pretend that I understand TLS fully, but I highly doubt it's the same thing. This is also assuming what you just linked is from the TLS server that X/Y use.

Zaneris

Zaneris

Posted
Posted
  Keplar said:
16 byte checksum? That sounds more like an MD5 hash, in my opinion. Out of curiosity, I've coded a small script to hash all possible data segments of the packet's payload, and compare these hashes for a possible match. Unfortunately, no hashed data segments of my packet matched. Perhaps a salted MD5 hash is being used?

This is my thought... but with what?

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing
×
×
  • Create New...