2010-03-21T07:00:37Z

Magical: /* Pokémon struct */ explain the extra 56 bytes

The following is '''wild conjecture''' based on LordLandon's [http://projectpokemon.org/forums/showthread.php?780-GTC-website-research&p=67086&viewfull=1#post67086 sendpkm.py].

Communication with the GTS is done over regular HTTP with http://gamestats2.gs.nintendowifi.net/. The same protocol is used for all five Gen IV games.

==HTTP headers==

The games don't seem to care about these at all. The GTS sends back a bunch of boilerplate response headers, but the game happily accepts a response with only a Content-Length.

==Protocol==

All requests to the server are GET requests of the form <code><var>page</var>.asp?pid=<var>pid</var>&hash=<var>hash</var>&data=<var>data</var></code>.

===pid===

The pid is an unsigned 32-bit integer that appears to uniquely identify a game cartridge. When the pid is obtained and whether the pid has any relation to the Pal Pad friend code are unknown.

For the mathematically inclined: Eevee's Platinum pid is 192615460 (0x0b7b1424) and his Pal Pad code is 0904 2026 4621.

===Challenge/response===

Before each "real" request, the game sends a request of the form <code><var>page</var>.asp?pid=<var>pid</var></code> and the server responds with a 32-byte hex challenge token. The game computes <code>sha1("sAdeqWo3voLeC5r16DYv" + token)</code> and uses that as the <var>hash</var> value which it sends to the server. The <var>data</var> parameter is encrypted with an unknown algorithm.

That is, each request looks like the following:

# Game requests <code>GET /pokemondpds/<var>page</var>.asp?pid=<var>pid</var></code>
# Server responds with <var>token</var>
# Game requests <code>GET /pokemondpds/<var>page</var>.asp?pid=<var>pid</var>&hash=<var>sha1(...)</var>&data=<var>data</var></code>
# Server responds with payload

Unfortunately, this means that the exact details of the game's requests are currently not known.

==Conversation==

The first request the game makes is to <code>/pokemondpds/worldexchange/info.asp</code>. The server responds with 0x0001.

Platinum, Heart Gold, and Soul Silver will then make a request to <code>/pokemondpds/common/setProfile.asp</code>. The server responds with eight NULs (0x00000000 0x00000000).

After the above step(s) or '''performing any of the tasks below''', the game makes a request to <code>/pokemondpds/worldexchange/result.asp</code>. If the game has had a Pokémon sent to it (via a successful trade?), the server responds with the entire encrypted [[Pokemon NDS Structure|Pokémon save struct]]. If there is a Pokémon uploaded to the GTS, it responds with 0x0004. Otherwise, it responds with 0x0005.

===Receiving a Pokémon===

If the game receives a Pokémon from a successful trade as a response from <code>result.asp</code>, it next requests <code>/pokemondpds/worldexchange/delete.asp</code>. The server responds with 0x0001.

====A note on sendpkm.py====

After doing the above, some Platinum, Heart Gold, and Soul Silver games will report a communication error and dump the player back to the title screen. The Pokémon is still successfully received. At least one person with HG/SS has received a Pokémon from a fake server without getting the error, and Diamond/Pearl have never been reported to have the problem. It's possible that the server should respond with something other than 0x0001.

===Offering a Pokémon===

Pokémon are offered on the GTS by requesting <code>/pokemondpds/worldexchange/post.asp</code>, followed by <code>/pokemondpds/worldexchange/post_finish.asp</code>.

===Retrieving an offered Pokémon===

Checking on the currently offered Pokémon is apparently done by <code>/pokemondpds/worldexchange/get.asp</code>. The response appears to be a [[Pokemon NDS Structure|Pokémon save struct]].

Retrieving the currently offered Pokémon is done by <code>/pokemondpds/worldexchange/return.asp</code>. The response is merely 0x0001; the actual Pokémon data is taken from the <code>get.asp</code> request.

===Searching===

Searching is done through <code>/pokemondpds/worldexchange/search.asp</code>. The sent data is 15 bytes long.

The server responds with a full 292-byte Pokémon struct for each result. If there are <var>n</var> results, the response will be 292 * <var>n</var> bytes long.

==Pokémon struct==

The Pokémon data for the GTS is 292 bytes—56 bytes larger than a party Pokémon struct. The extra 56 bytes are GTS-specific data, such as the player's name & country, and what Pokémon they are requesting.

They are as follows:

<pre>
0x00-0x01 Current Pokémon
0x02 Gender 1=male; 2=female; 3=either/neither
0x03 Level
0x04-0x05 Requested Pokémon
0x06 Gender
0x07 Min level
0x08 Max level
0x09 always 0?
0x10 sometimes 1, sometimes 0
0x0B always 0?
0x0C Year deposited
0x0D moar year dep'd
0x0E Month dep'd
0x0F Day dep'd
0x10 Hour dep'd
0x11 Minute dep'd
0x12 Second depd'd
0x13 always 0?
0x14-0x1a Another timestamp. Time traded away?
0x1b always 0?
0x1c-0x1f PID - also 0x4c in the sav
0x20-0x2F OT Name
0x30-0x31 OT ID
0x32 Country
0x33 City
0x34-0x37 Unknown
</pre>

GTS protocol

2010-03-21T04:01:09Z

Magical: /* Searching */

GTS protocol

2010-03-21T03:59:53Z

Magical: /* Searching */ New section

GTS protocol

2010-03-21T03:28:48Z

Magical: headers

GTS protocol

2010-03-21T01:49:53Z

Magical:

GTS protocol

2010-03-21T01:39:23Z

Magical: