GTS protocol

The following is wild conjecture based on LordLandon's sendpkm.py.

Communication with the GTS is done over regular HTTP with http://gamestats2.gs.nintendowifi.net/.

HTTP headers

The games don't seem to care about these at all. The GTS sends back a bunch of boilerplate response headers, but the game happily accepts a response with only a Content-Length.

Protocol

This takes the form of HTTP GET requests to the server. The requests are of the form <page>.asp?pid=<pid>&hash=<hash>&data=. Before each "real" request, the game sends a request of the form <page>.asp?pid=<pid> and the server responds with a 32-byte challenge token. The game computes sha1("sAdeqWo3voLeC5r16DYv" + token) and uses that as the hash value which it sends to the server. The data parameter is encrypted with an unknown algorithm.

The first request the game makes is to /pokemondpds/worldexchange/info.asp. The server responds with 0x0001.

Next, it makes a request to /pokemondpds/worldexchange/result.php. If there is a Pokémon stored at the GTS, the server responds with 0x0005, otherwise it responds with 0x0004.