| User |
Post
|
Guy Perfect
   
   
      
 
  
Since: 11-18-05
Last post: 6297 days
Last view: 6296 days
|
| Posted on 05-02-06 10:17 PM |
Link
| |
As promised, the F-Zero X editor is essentially ready for public release and now I'm beginning to work on reverse-engineering the Nintendo Wi-Fi Connection stuff coming out of various Nintendo DS games.
The way I am going about doing this involves a Linux machine equipped with some networking hardware and some simple configuration. The configuration in question is something that Windows cannot do (it can, but you'll probably never see it): Master mode. Master is nothing more than the recieving node on an Infrastructure network.
Using a Cisco PI21AG wireless card and the MadWiFi driver, I was able to get a Master node hooked up to the Linux machine. Working with IP forwarding and some iptables configuration with DHCP servicing, I was able to get Nintendo DS units to connect to the Linux box in order to connect them to the internet.
Working with iptables again, I redirected all traffic coming in from the wireless card to my other computer, regardless of where they were originally destined for. Programming a utility that the DS units can communicate with, I have the starts of a network passthrough that I can use to capture packets as they go to and from Nintendo's servers.
Original tests determined that the first connectivity made is the Nintendo DS unit making a Joe-average HTTP request to Joe-average TCP port 80. This is what the DS sends from Metroid Prime Hunters:
GET / HTTP/1.0
Host: conntest.nintendowifi.net
Connection: close
Opening a connection to conntest.nintendowifi.net on TCP port 80, I forwarded that data to the server to see what came back. This is how the server responded:
HTTP/1.1 200 OK
Date: Tue, 02 May 2006 22:58:10 GMT
Server: GameCube
Last-Modified: Tue, 07 Mar 2006 15:53:42 GMT
ETag: "c9c3-f6-40e69a5bfad80"
Accept-Ranges: bytes
Content-Length: 246
NODE: wifiappe2, wifiappe2
Connection: close
Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>HTML Page</title>
</head>
<body bgcolor="#FFFFFF">
This is test.html page
</body>
</html>
It's apparent by looking at the response that there's not a lot of information there. Most likely, this is just used for the DS to be aware that the server is there and able to respond. The fact that the request was made with HTTP 1.0 is indicative that the server is designed to reject requests from present-day browsers, which use HTTP 1.1 by default. This is understandable, since the HTML page returned is less than informative.
Of interest is that ETag header, which is nothing more than a hex-encoded string of unknown significance. This may prove to be useful later, but right now it's a mystery.
Server could be either the server name or system. I wouldn't put it past Nintendo to host Wi-Fi Connection on GameCube hardware. NODE is also unknown. wifiappe2 appears to be some kind of identifier, but I don't know its significance as of yet. There are two of them, which leads me to believe that there are two distinct services available and they're currently both hosted by the same server. This leads me to believe that wifiappe2 is possibly part of the domain name of the server.
After the HTTP request comes back, the DS sends a second piece of information to TCP port 443. I'll have to set up some logging on the Linux box, 'cause I don't know where it's supposed to go. conntest.nintendowifi.net is not accepting requests on that port, so a log is required to find out the intended IP destination of the host.
Regardless of that, the information being passed is a mystery as well. The DS sends a short, 52/53-byte bit of data to the mystery server, and the significance of this data is unknown as well. To make matters worse, the data, seemingly random, becomes significantly different each time a connection to WFC is made. This may be encryption based off of a timer, or it might simply be random data. Whatever the case, the data is not known. Here's the output from two runs:
Round 1; May 02, 2006, 6:14:50 PM CDT
000000 16 03 00 00 2F 01 00 00 2B 03 00 44 57 A5 13 5F ..../...+..DW.._
000010 A2 6A B6 69 45 39 7A 1D AE 83 6A 12 9E 24 6E 9E .j.iE9z...j..$n.
000020 6B 64 20 A0 9F 58 AB 27 F7 CE BE 00 00 04 00 04 kd ..X.'........
000030 00 05 01 00 00 .....
Round 2; May 02, 2006, 6:13:47 PM CDT
000000 16 03 00 00 2F 01 00 00 2B 03 00 44 57 A1 4D AD ..../...+..DW.M.
000010 10 23 0E 31 4D C6 F3 81 54 61 A0 85 61 13 C2 40 .#.1M...Ta..a..@
000020 D9 33 DA A2 06 BC 47 03 BA EA 78 00 00 04 00 04 .3....G...x.....
000030 00 05 01 00 ....
The data at the beginning and end of those two chunks is identical, but the stuff in between is all over the place. Nothing is consistant with any of the information I know about the system, so exactly what's going on here is a mystery. The MAC address of my DS isn't relayed. The Wi-Fi Connection ID may be in there, but I'll have to get home and on my DS to check that out.
Does anyone have any ideas of what might be sent in this last little packet here? Or perhaps where it's going? I can find that one out easily, but I would still like to know the significance of the data.
Questions and comments will be appreciated.
(edited by BGNG on 05-02-06 09:17 PM)
|
Alchemic
Since: 11-17-05
Last post: 6409 days
Last view: 6295 days
|
| Posted on 05-02-06 11:03 PM |
Link
| |
TCP port 443 is used for HTTP over TLS/SSL, according to the IANA port list.
The ETag header is described in RFC 2616:
http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.19
I'm not quite sure what it's used for from that description, though. |
Guy Perfect
Since: 11-18-05
Last post: 6297 days
Last view: 6296 days
|
| Posted on 05-02-06 11:52 PM |
Link
| |
After some iptables logging, I was able to trace the port 443 host as nas.nintendowifi.net. This is apparently the default server for my game; possibly the North American default, possibly the global default.
When the data came in, my passthrough failed. I have some buggy, slap-together code put up at the moment for testing, but it looks like I'll have to carefully design a good system to work with.
The data that managed to get through, however, was promising. Amongst the jumble of garbage, the following can be read in a text viewer:
Washington
Nintendo of America Inc
Nintendo CA
ca@noa.nintendo.com
Redmond
Nintendo Wifi Network
nas.nintendowifi.net
OpenSSL Generated Certificate
How 'bout that, huh? OpenSSL, right there in plain view. Just like Alchemic said. Thanks for the tip, Alchemic. I'll be heading into SSL as soon as I get that new passthrough programmed. |
Guy Perfect
Since: 11-18-05
Last post: 6297 days
Last view: 6296 days
|
| Posted on 05-22-06 01:31 AM |
Link
| |
It's been a while since I have another project that I'd like to work on. But that project has come to a screeching halt because the only known means of progress is upwards of $2,000, which isn't something I'm willing to spend.
Anyways, I've re-programmed my TCP network passthrough and it seems to work like a charm. Working with Metroid Prime Hunters, I was able to get into the Friends and Rivals menus perfectly without any networking errors along the way. And all of the traffic was flowing through the passthrough software.
Thank the heavens for Linux and its ability to log destination IP addresses, because that has indubidably helped me figure out where the traffic WAS heading before I redirected it to the network passthrough.
I now know 4 of the 6 TCP ports that need to be open for Wi-Fi Connection, at least as far as Metroid Prime Hunters is concerned. It's obviously best to have domain names, but no reverse DNS lookup has been able to give me a domain name for some of my IP addresses, which may prove problematic in the future.
The TCP ports and corresponding destinations are as follows:
Port Address Service
-------------------------------------------------
80 conntest.nintendowifi.net HTTP
443 nas.nintendowifi.net SSL (HTTP?)
29900 207.38.11.34 [Menus]
29920 gamestats.gamespy.com [Game Stats]
If anyone knows how to get domain names off of those IP's, it'd be greatly appreciated.
When I'm done configuring the passthrough software, I'll post it and its source code here for downloads so others can experiment.
EDIT:
After trying an ordinary traceroute, I've found that port 29920 ends up at gamestats.gamespy.com, which indicates that this is likely the server where player stats come from.
(edited by BGNG on 05-22-06 12:35 AM)
|
MegaByte
Newcomer
Since: 05-01-06
Last post: 6540 days
Last view: 6540 days
|
| Posted on 05-22-06 02:17 AM |
Link
| |
| ETags are normally used to determine whether content has changed since the last request. It's like a checksum. |
Techokami
Porcupo
Since: 12-03-05
From: Mass-uh-chew-sits USofA
Last post: 6310 days
Last view: 6296 days
|
| Posted on 05-22-06 02:49 PM |
Link
| |
whois is your friend =)
IP: 207.38.11.34
Location: United States [City: Irvine, California]
Intelenet Communications INTELENET-207 (NET-207-38-0-0-1)
207.38.0.0 - 207.38.127.255
GameSpy Industries ICI-GAMESPY-3 (NET-207-38-8-0-1)
207.38.8.0 - 207.38.15.255
So of all the people on this damn planet, GameSpy is running the WiFi Connection. WTF? O_o |
blackhole89
Moronic Thread Bodycount: 17
(since 2006-08-21 09:50 EST)
F5 F5 F5 F5 F5
Since: 12-31-69
From: Dresden/SN/DE
Last post: 6297 days
Last view: 6295 days
|
| Posted on 05-22-06 04:35 PM |
Link
| |
| Moved to General Hacking as this doesn't really involve ROMs or hacking thereof. |
Guy Perfect
Since: 11-18-05
Last post: 6297 days
Last view: 6296 days
|
| Posted on 05-22-06 05:10 PM |
Link
| |
MegaByte:
Thanks for the info about ETag. I was curious about that, but it seemed inconsenquential enough to not look it up.
Techokami:
Thanks for the effort, but WhoIs doesn't (as a rule of thumb) provide domain names for IP addresses. For example, "www.google.com" is a domain name and "66.102.7.147" is the corresponding IP address. What I need is the domain name for 207.38.11.34.
GameSpy is indeed the backbone of Nintendo WiFi Connection. I remember hearing about that at the PrE3 2005 media briefing.
blackhole89:
Thanks for the move. I didn't want to post it in ROM hacking back in the day, but there wasn't a better forum then. Now there is.
(edited by BGNG on 05-22-06 04:11 PM)
|
FreeDOS +
Giant Red Koopa
Legion: freedos = fritos
Since: 11-17-05
From: Seattle
Last post: 6295 days
Last view: 6295 days
|
| Posted on 05-22-06 05:25 PM |
Link
| |
Sure it does, DNS is designed to provide resolution of both names and IP addresses. Just as Techo said, the output of whois(1) is:
bash-3.1$ whois 207.38.11.34
Intelenet Communications INTELENET-207 (NET-207-38-0-0-1)
207.38.0.0 - 207.38.127.255
GameSpy Industries ICI-GAMESPY-3 (NET-207-38-8-0-1)
207.38.8.0 - 207.38.15.255
---
Yeah, like you've already established, ignore this. I'll go beat myself up over posting while half-asleep. whois queries are not DNS lookups, as often as they might be mistaken as 
(edited by FreeDOS + on 05-23-06 12:24 AM)
|
Guy Perfect
Since: 11-18-05
Last post: 6297 days
Last view: 6296 days
|
| Posted on 05-23-06 01:12 AM |
Link
| |
My previous post was a multi-edited conglomeration of "Maybe this will work!" and "That didn't work," so I just deleted it. 'Course, this board also has a 24-hour rule if you want to post in a thread when you already have the last post... Anyhow...
FreeDOS, no domain name is provided in that WhoIs output. Domain names are the identifiers that end in .com and .net, etc. No worries, though, 'cause I got what I was looking for.
I found a program for Linux called tcpdump that listens to interfaces as packets pass through the kernel. Using that program, I was able to pull out all the domain names from the DS's DNS queries. Here is the most up-to-date list:
| Port | Address | Service | 80 | conntest.nintendowifi.net | HTTP | 443 | nas.nintendowifi.net | HTTPS | 28910 | mprimeds.ms13.gs.nintendowifi.net | [Game Management] | 29900 | gpcm.gs.nintendowifi.net
mprimeds.master.gs.nintendowifi.net | [Menus] | 29901 | --- | --- | 29920 | gamestats.gamespy.com | [Game/Player Stats] |
|
This update shows that port 28910 now has information to go with it. That socket was used when I went into "Find a Game" mode and searched for a game with other players involved.
Port 29900 shows two addresses. They are indeed two distinct domain names, but both of them resolve to the same IP address, which is peculiar. This may prove problematic in the future where the "gpcm" server and game master server are in different locations. In my connection log, I didn't see any disconnections from that port after connecting to gpcm.gs.nintendowifi.net, which makes me wonder how both of those domain names got out of the DS.
Port 29901 has currently not been used in any of my experimentations as of yet.
This chart applies only to TCP connections. |
blackhole89
Moronic Thread Bodycount: 17
(since 2006-08-21 09:50 EST)
F5 F5 F5 F5 F5
Since: 12-31-69
From: Dresden/SN/DE
Last post: 6297 days
Last view: 6295 days
|
| Posted on 05-24-06 04:39 AM |
Link
| |
Originally posted by BGNG
Round 1; May 02, 2006, 6:14:50 PM CDT
000000 16 03 00 00 2F 01 00 00 2B 03 00 44 57 A5 13 5F ..../...+..DW.._
000010 A2 6A B6 69 45 39 7A 1D AE 83 6A 12 9E 24 6E 9E .j.iE9z...j..$n.
000020 6B 64 20 A0 9F 58 AB 27 F7 CE BE 00 00 04 00 04 kd ..X.'........
000030 00 05 01 00 00 .....
Round 2; May 02, 2006, 6:13:47 PM CDT
000000 16 03 00 00 2F 01 00 00 2B 03 00 44 57 A1 4D AD ..../...+..DW.M.
000010 10 23 0E 31 4D C6 F3 81 54 61 A0 85 61 13 C2 40 .#.1M...Ta..a..@
000020 D9 33 DA A2 06 BC 47 03 BA EA 78 00 00 04 00 04 .3....G...x.....
000030 00 05 01 00 ....
The offset 0Bh in both records holds the quite precise timestamp of the time you noted for recording this ... in little-endian format.
The following 28, random-seeming hexadecimal numbers *might* be the public key for an RSA encoding... to see whether they actually are, I'd need to see the server's reaction. Either way, the number they give isn't prime, and has no lower factors, which means it probably is a product of two numbers roughly the same size. Though, an 896-bit encryption isn't something I would call quite common...
(edited by blackhole89 on 05-24-06 02:33 PM)
|
Guy Perfect
Since: 11-18-05
Last post: 6297 days
Last view: 6296 days
|
| Posted on 05-24-06 06:09 PM |
Link
| |
Major Edit Below
My previous post was a partially informative explination of the byte sequence. This post has the full scoop.
blackhole89, you were right about the time. It's expressed in Unix-style GMT.
This is the total breakdown of "Round 2":
000000 16 03 00 00 2F 01 00 00 2B 03 00 44 57 A1 4D AD ..../...+..DW.M.
000010 10 23 0E 31 4D C6 F3 81 54 61 A0 85 61 13 C2 40 .#.1M...Ta..a..@
000020 D9 33 DA A2 06 BC 47 03 BA EA 78 00 00 04 00 04 .3....G...x.....
000030 00 05 01 00
16 - Fragment Type (0x16; Handshake)
03 00 - Protocol Version (3.0)
00 2F - Fragment Length (47 bytes)
01 - Handshake Type (0x01; Client Hello)
00 00 2B - Client Hello Length (43 bytes)
03 00 - Protocol Version (3.0)
44 57 A1 4D - GMT Unix Time (Still need to look into this)
Client Hello Random sequence (28 bytes):
AD 10 23 0E 31 4D C6 F3 81 54 61 A0 85 61 13 C2
40 D9 33 DA A2 06 BC 47 03 BA EA 78
00 - Session ID Length (0 bytes)
- Session ID (empty)
00 04 - Cipher Suites Length (4 bytes)
00 04 - Cipher Suite 1 (0x00, 0x04; RSA w/RC4-128 MD5)
00 05 - Cipher Suite 2 (0x00, 0x05; RSA w/RC4-128 SHA)
01 - Compression Methods Length (1 byte)
00 - Compression Method 1 (0x00; NULL)
Or, that is to say, this specification
EDIT:
Okay, I've set up a logging system in my passthrough that records all events and data that occurs. What I did was go into Metroid Prime Hunters' "Friends and Rivals" mode, then immediately exited when I was in. The following log is everything that happened.
This log will serve as the basis for analysis for a few days now, so I invite anyone willing to see what they can figure out about it.
10.0.0.2 is the IP of my Linux box. Until I set up some DNS spoofing, I won't be able to return the exact IP address of the DS units.
TCP 1 added on port 80 (conntest.nintendowifi.net)
TCP 2 added on port 443 (nas.nintendowifi.net)
TCP 3 added on port 28910 (mprimeds.ms13.gs.nintendowifi.net)
TCP 4 added on port 29900 (gpcm.gs.nintendowifi.net)
TCP 5 added on port 29901 ()
TCP 6 added on port 29920 (gamestats.gamespy.com)
Request on TCP 1
Connect on TCP 1.1 (conntest.nintendowifi.net)
Accept on TCP 1.1 (10.0.0.2)
Local-Remote on TCP 1.1
000000 47 45 54 20 2F 20 48 54 54 50 2F 31 2E 30 0D 0A GET / HTTP/1.0..
000010 48 6F 73 74 3A 20 63 6F 6E 6E 74 65 73 74 2E 6E Host: conntest.n
000020 69 6E 74 65 6E 64 6F 77 69 66 69 2E 6E 65 74 0D intendowifi.net.
000030 0A 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20 63 6C 6F .Connection: clo
000040 73 65 0D 0A 0D 0A se....
Remote-Local on TCP 1.1
000000 48 54 54 50 2F 31 2E 31 20 32 30 30 20 4F 4B 0D HTTP/1.1 200 OK.
000010 0A 44 61 74 65 3A 20 57 65 64 2C 20 32 34 20 4D .Date: Wed, 24 M
000020 61 79 20 32 30 30 36 20 32 30 3A 32 31 3A 30 34 ay 2006 20:21:04
000030 20 47 4D 54 0D 0A 53 65 72 76 65 72 3A 20 47 61 GMT..Server: Ga
000040 6D 65 43 75 62 65 0D 0A 4C 61 73 74 2D 4D 6F 64 meCube..Last-Mod
000050 69 66 69 65 64 3A 20 54 75 65 2C 20 30 37 20 4D ified: Tue, 07 M
000060 61 72 20 32 30 30 36 20 31 35 3A 35 33 3A 34 32 ar 2006 15:53:42
000070 20 47 4D 54 0D 0A 45 54 61 67 3A 20 22 63 39 66 GMT..ETag: "c9f
000080 38 2D 66 36 2D 34 30 65 36 39 61 35 62 66 61 64 8-f6-40e69a5bfad
000090 38 30 22 0D 0A 41 63 63 65 70 74 2D 52 61 6E 67 80"..Accept-Rang
0000A0 65 73 3A 20 62 79 74 65 73 0D 0A 43 6F 6E 74 65 es: bytes..Conte
0000B0 6E 74 2D 4C 65 6E 67 74 68 3A 20 32 34 36 0D 0A nt-Length: 246..
0000C0 4E 4F 44 45 3A 20 77 69 66 69 61 70 70 65 33 0D NODE: wifiappe3.
0000D0 0A 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20 63 6C 6F .Connection: clo
0000E0 73 65 0D 0A 43 6F 6E 74 65 6E 74 2D 54 79 70 65 se..Content-Type
0000F0 3A 20 74 65 78 74 2F 68 74 6D 6C 0D 0A 0D 0A 3C : text/html....<
000100 21 44 4F 43 54 59 50 45 20 68 74 6D 6C 20 50 55 !DOCTYPE html PU
000110 42 4C 49 43 20 22 2D 2F 2F 57 33 43 2F 2F 44 54 BLIC "-//W3C//DT
000120 44 20 58 48 54 4D 4C 20 31 2E 30 20 54 72 61 6E D XHTML 1.0 Tran
000130 73 69 74 69 6F 6E 61 6C 2F 2F 45 4E 22 20 22 68 sitional//EN" "h
000140 74 74 70 3A 2F 2F 77 77 77 2E 77 33 2E 6F 72 67 ttp://www.w3.org
000150 2F 54 52 2F 78 68 74 6D 6C 31 2F 44 54 44 2F 78 /TR/xhtml1/DTD/x
000160 68 74 6D 6C 31 2D 74 72 61 6E 73 69 74 69 6F 6E html1-transition
000170 61 6C 2E 64 74 64 22 3E 0A 3C 68 74 6D 6C 3E 0A al.dtd">.<html>.
000180 20 20 20 20 0A 3C 68 65 61 64 3E 0A 09 09 3C 74 .<head>...<t
000190 69 74 6C 65 3E 48 54 4D 4C 20 50 61 67 65 3C 2F itle>HTML Page</
0001A0 74 69 74 6C 65 3E 0A 3C 2F 68 65 61 64 3E 0A 0A title>.</head>..
0001B0 3C 62 6F 64 79 20 62 67 63 6F 6C 6F 72 3D 22 23 <body bgcolor="#
0001C0 46 46 46 46 46 46 22 3E 0A 54 68 69 73 20 69 73 FFFFFF">.This is
0001D0 20 74 65 73 74 2E 68 74 6D 6C 20 70 61 67 65 0A test.html page.
0001E0 3C 2F 62 6F 64 79 3E 0A 20 20 20 20 0A 3C 2F 68 </body>. .</h
0001F0 74 6D 6C 3E 0A tml>.
remote Close on TCP 1.1
Destroy on TCP 1.1
Request on TCP 2
Connect on TCP 2.1 (nas.nintendowifi.net)
Accept on TCP 2.1 (10.0.0.2)
Local-Remote on TCP 2.1
000000 16 03 00 00 2F 01 00 00 2B 03 00 39 2B F3 5A 66 ..../...+..9+.Zf
000010 6B F2 B1 9D 4D 98 95 5F 31 43 14 DD AF FB C6 BB k...M.._1C......
000020 61 B2 E6 7B 65 FA 7C 22 E6 9F 97 00 00 04 00 04 a..{e.|"........
000030 00 05 01 00 ....
Remote-Local on TCP 2.1
000000 16 03 00 00 4A 02 00 00 46 03 00 E9 28 09 47 ED ....J...F...(.G.
000010 FD DA AD B4 09 71 4B AE 8E 6E A2 C5 15 5B 9A A1 .....qK..n...[..
000020 E4 4F 79 31 FE F0 8D 0B 17 61 A9 20 CB E9 03 73 .Oy1.....a. ...s
000030 3C 91 49 BC 28 55 33 0A 5A 91 A3 F4 95 36 2A CD <.I.(U3.Z....6*.
000040 B1 D1 0A D8 D4 86 9B B7 44 37 4F 25 00 04 00 16 ........D7O%....
000050 03 00 03 C2 0B 00 03 BE 00 03 BB 00 03 B8 30 82 ..............0.
000060 03 B4 30 82 03 1D A0 03 02 01 02 02 01 04 30 0D ..0...........0.
000070 06 09 2A 86 48 86 F7 0D 01 01 05 05 00 30 81 8C ..*.H........0..
000080 31 0B 30 09 06 03 55 04 06 13 02 55 53 31 13 30 1.0...U....US1.0
000090 11 06 03 55 04 08 13 0A 57 61 73 68 69 6E 67 74 ...U....Washingt
0000A0 6F 6E 31 20 30 1E 06 03 55 04 0A 13 17 4E 69 6E on1 0...U....Nin
0000B0 74 65 6E 64 6F 20 6F 66 20 41 6D 65 72 69 63 61 tendo of America
0000C0 20 49 6E 63 31 0C 30 0A 06 03 55 04 0B 13 03 4E Inc1.0...U....N
0000D0 4F 41 31 14 30 12 06 03 55 04 03 13 0B 4E 69 6E OA1.0...U....Nin
0000E0 74 65 6E 64 6F 20 43 41 31 22 30 20 06 09 2A 86 tendo CA1"0 ..*.
0000F0 48 86 F7 0D 01 09 01 16 13 63 61 40 6E 6F 61 2E H........ca@noa.
000100 6E 69 6E 74 65 6E 64 6F 2E 63 6F 6D 30 1E 17 0D nintendo.com0...
000110 30 35 30 32 31 39 30 34 33 32 35 31 5A 17 0D 31 050219043251Z..1
000120 35 30 32 31 37 30 34 33 32 35 31 5A 30 81 96 31 50217043251Z0..1
000130 0B 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 .0...U....US1.0.
000140 06 03 55 04 08 13 0A 57 61 73 68 69 6E 67 74 6F ..U....Washingto
000150 6E 31 10 30 0E 06 03 55 04 07 13 07 52 65 64 6D n1.0...U....Redm
000160 6F 6E 64 31 21 30 1F 06 03 55 04 0A 13 18 4E 69 ond1!0...U....Ni
000170 6E 74 65 6E 64 6F 20 6F 66 20 41 6D 65 72 69 63 ntendo of Americ
000180 61 20 49 6E 63 2E 31 1E 30 1C 06 03 55 04 0B 13 a Inc.1.0...U...
000190 15 4E 69 6E 74 65 6E 64 6F 20 57 69 66 69 20 4E .Nintendo Wifi N
0001A0 65 74 77 6F 72 6B 31 1D 30 1B 06 03 55 04 03 13 etwork1.0...U...
0001B0 14 6E 61 73 2E 6E 69 6E 74 65 6E 64 6F 77 69 66 .nas.nintendowif
0001C0 69 2E 6E 65 74 30 81 9F 30 0D 06 09 2A 86 48 86 i.net0..0...*.H.
0001D0 F7 0D 01 01 01 05 00 03 81 8D 00 30 81 89 02 81 ...........0....
0001E0 81 00 A3 73 65 8C 53 30 8B 96 9A 1A 9C F0 F9 EF ...se.S0........
0001F0 40 2B C8 04 0D 2C 51 8A 53 CC 86 8E FF E6 F8 5E @+...,Q.S......^
000200 95 CE 1C 91 E4 2F 7F 67 9B 7F 04 9F 0C 09 C8 3A ...../.g.......:
000210 30 93 0C 77 5E DF 81 2A F0 1A CD 53 C7 AD E8 11 0..w^..*...S....
000220 A2 86 8D AB C6 1A F9 D3 0D 91 93 BF F8 9E A8 80 ................
000230 E9 CA 56 90 3B 31 B1 F1 07 92 F9 F4 D5 A3 C0 F9 ..V.;1..........
000240 E9 13 9E B7 67 9A 63 B0 BE 4C 84 97 31 E5 38 0F ....g.c..L..1.8.
000250 10 99 1F E9 55 DC 41 42 54 7F 1C 9F CF 22 09 2D ....U.ABT....".-
000260 F2 FB 02 03 01 00 01 A3 82 01 18 30 82 01 14 30 ...........0...0
000270 09 06 03 55 1D 13 04 02 30 00 30 2C 06 09 60 86 ...U....0.0,..`.
000280 48 01 86 F8 42 01 0D 04 1F 16 1D 4F 70 65 6E 53 H...B......OpenS
000290 53 4C 20 47 65 6E 65 72 61 74 65 64 20 43 65 72 SL Generated Cer
0002A0 74 69 66 69 63 61 74 65 30 1D 06 03 55 1D 0E 04 tificate0...U...
0002B0 16 04 14 AA 1A 38 11 7C 6C 66 63 49 FB B8 A7 8C .....8.|lfcI....
0002C0 F4 A3 D0 E4 EE C6 37 30 81 B9 06 03 55 1D 23 04 ......70....U.#.
0002D0 81 B1 30 81 AE 80 14 7B 57 53 3F 31 AC 77 71 F1 ..0....{WS?1.wq.
0002E0 FD 4A E6 0F 43 B0 D5 55 41 9F D2 A1 81 92 A4 81 .J..C..UA.......
0002F0 8F 30 81 8C 31 0B 30 09 06 03 55 04 06 13 02 55 .0..1.0...U....U
000300 53 31 13 30 11 06 03 55 04 08 13 0A 57 61 73 68 S1.0...U....Wash
000310 69 6E 67 74 6F 6E 31 20 30 1E 06 03 55 04 0A 13 ington1 0...U...
000320 17 4E 69 6E 74 65 6E 64 6F 20 6F 66 20 41 6D 65 .Nintendo of Ame
000330 72 69 63 61 20 49 6E 63 31 0C 30 0A 06 03 55 04 rica Inc1.0...U.
000340 0B 13 03 4E 4F 41 31 14 30 12 06 03 55 04 03 13 ...NOA1.0...U...
000350 0B 4E 69 6E 74 65 6E 64 6F 20 43 41 31 22 30 20 .Nintendo CA1"0
000360 06 09 2A 86 48 86 F7 0D 01 09 01 16 13 63 61 40 ..*.H........ca@
000370 6E 6F 61 2E 6E 69 6E 74 65 6E 64 6F 2E 63 6F 6D noa.nintendo.com
000380 82 01 00 30 0D 06 09 2A 86 48 86 F7 0D 01 01 05 ...0...*.H......
000390 05 00 03 81 81 00 95 2A D5 3A D6 2D 39 34 79 D4 .......*.:.-94y.
0003A0 3B 89 C6 44 E4 3D A4 7C FE 66 4A FF D5 A4 3A E2 ;..D.=.|.fJ...:.
0003B0 7E A0 7F BD DA 8A 5C 5C 10 84 91 0E F3 2F 6D 11 ~.....\\...../m.
0003C0 E1 40 D0 0F 38 79 ED 4C 22 71 77 39 45 C6 D7 6F .@..8y.L"qw9E..o
0003D0 A7 47 1C F6 89 12 EE F9 80 20 F0 0F 3D 20 6A 7F .G....... ..= j.
0003E0 21 D8 CA 1E D0 71 32 12 8A 9D 52 0D EA E5 35 83 !....q2...R...5.
0003F0 CF 1B 7B 11 BD 92 90 F4 3A 8F 4A B8 22 3C 42 B8 ..{.....:.J."<B.
000400 50 2A AF EF 5A F8 1B D0 97 A7 A5 87 5E 4D AD 9E P*..Z.......^M..
000410 88 5D 77 74 EA E3 16 03 00 00 04 0E 00 00 00 .]wt...........
Local-Remote on TCP 2.1
000000 16 03 00 00 84 10 00 00 80 64 9A 67 78 86 E3 72 .........d.gx..r
000010 B9 71 22 34 E8 40 A7 69 5A 63 9A 0F 08 96 CF 7C .q"4.@.iZc.....|
000020 B5 D6 46 31 73 02 A1 A9 12 2E 35 EE A1 2D 13 CF ..F1s.....5..-..
000030 9F FD 4B C4 28 A6 1E 75 25 E5 2C AB 94 E0 96 90 ..K.(..u%.,.....
000040 B7 E6 8E 54 9F 40 A0 54 E0 E2 7C C6 70 73 C7 D9 ...T.@.T..|.ps..
000050 A6 9A 7A C1 F6 34 D1 A4 9B 98 2B 2A 42 CA A6 1F ..z..4....+*B...
000060 B9 58 1D E5 8F EF 16 A2 4E 0C 63 16 DB B3 AC 93 .X......N.c.....
000070 F4 20 0A 8F E1 56 CB 7E 66 2C 1B 68 83 4D 9E 87 . ...V.~f,.h.M..
000080 C7 C9 35 60 F7 73 8F 0A E7 ..5`.s...
Local-Remote on TCP 2.1
000000 14 03 00 00 01 01 16 03 00 00 38 59 6E 25 30 EC ..........8Yn%0.
000010 CF E1 64 8E F7 84 E6 C2 8C AE 95 F1 6F 4F AE A5 ..d.........oO..
000020 8C B0 F9 21 18 28 3D 48 F4 0F 6D 4B AB 54 A5 4E ...!.(=H..mK.T.N
000030 D0 A6 60 8D 35 1B 66 CF D8 58 2B A3 D8 11 62 FC ..`.5.f..X+...b.
000040 B4 56 50 .VP
Remote-Local on TCP 2.1
000000 14 03 00 00 01 01 16 03 00 00 38 45 4F B8 40 B2 ..........8EO.@.
000010 29 F1 D4 2A 15 6B 34 07 A7 37 61 DC AF 41 F7 A1 )..*.k4..7a..A..
000020 CA 8E D5 10 3E 2C A9 A4 ED 9E 3E 7B D9 97 74 24 ....>,....>{..t$
000030 3C 6F C2 A1 9D 7D FA E0 23 D0 4F 34 81 EF 04 52 <o...}..#.O4...R
000040 27 97 41 '.A
Local-Remote on TCP 2.1
000000 17 03 00 02 0B A0 95 D1 AD AA 88 57 AB 84 DF C3 ...........W....
000010 78 AB EF C2 EF 14 98 F9 A0 92 D9 09 A1 4C 3C 83 x............L<.
000020 8F 6C A7 88 36 C3 EB 57 8F 35 1A 69 BA 91 CD 83 .l..6..W.5.i....
000030 1A 25 3C A3 17 E2 29 A6 FF D4 27 8A 98 52 0B 56 .%<...)...'..R.V
000040 B2 0A 14 06 2D A9 04 82 03 76 11 E7 C1 A6 E4 61 ....-....v.....a
000050 6F 36 0F B0 0E 26 1A 68 66 CA E8 93 C9 FD 29 CB o6...&.hf.....).
000060 4C 9D 8F 4B 37 75 DA 88 BF 68 AB F7 DB 1E 42 36 L..K7u...h....B6
000070 73 9F 66 9A 49 42 91 4F 86 E4 C0 47 66 87 CF D0 s.f.IB.O...Gf...
000080 72 55 6B 42 E6 7C AC 73 8A EC 23 0D A5 BE 32 CC rUkB.|.s..#...2.
000090 F2 C0 2E D7 C3 56 AA 4C B5 18 CC 33 54 3F 2A 45 .....V.L...3T?*E
0000A0 6F CD 93 75 31 03 A8 78 E9 F1 C9 85 27 82 79 DE o..u1..x....'.y.
0000B0 97 9B 37 02 EF 60 C2 3C A6 4A EA 09 CB 00 2C D2 ..7..`.<.J....,.
0000C0 7E D9 BE D0 3B A9 8D 39 28 0B 2F C1 FD 7B 73 20 ~...;..9(./..{s
0000D0 6F 25 A9 41 96 E7 9B 9E 78 8A A4 FF DE 80 0F B3 o%.A....x.......
0000E0 5D 23 E3 61 85 C5 B4 82 B9 36 F9 40 07 23 E8 4E ]#.a.....6.@.#.N
0000F0 2A ED E4 FB DB 6E D5 7C FD B1 5A CF 1C 4D 81 CE *....n.|..Z..M..
000100 11 74 FD 64 D3 45 59 22 60 31 6E 41 16 86 46 88 .t.d.EY"`1nA..F.
000110 44 BC D4 A2 39 04 5A D7 71 1E 80 EA 0B 75 F0 93 D...9.Z.q....u..
000120 C6 32 3B F0 D9 7B 07 04 4E B9 BE C7 8E 40 8F AB .2;..{..N....@..
000130 20 3B 16 53 C0 B7 5B C6 08 0A E9 0D BE E0 8F E7 ;.S..[.........
000140 FD 0C E1 F7 08 8C 1D EE E9 57 4F 87 68 1F 08 B7 .........WO.h...
000150 4C 52 7F 86 1E 24 56 E3 33 61 78 B3 4A 1F 77 37 LR...$V.3ax.J.w7
000160 BD 4A 5A 54 11 DC 76 FE 2F 0B 2B F3 D0 33 32 F5 .JZT..v./.+..32.
000170 AC 04 14 F2 A5 1C A2 72 47 D0 85 9D B7 69 ED C3 .......rG....i..
000180 77 51 AE EC 86 88 44 E3 B4 95 CE 64 CA F9 53 65 wQ....D....d..Se
000190 A1 CB 96 DC FB 41 88 82 A2 C9 92 FF B8 F0 2F 13 .....A......../.
0001A0 B5 19 68 4C 27 20 11 28 E7 0D 8C 13 1D F5 DA 57 ..hL' .(.......W
0001B0 2C 3A E5 20 19 3E E1 32 7B DE 25 E0 56 86 2C 50 ,:. .>.2{.%.V.,P
0001C0 88 62 81 E9 DC 60 7A 77 73 9D E9 F1 F0 68 EF 7C .b...`zws....h.|
0001D0 F4 92 80 66 C2 A2 FE 79 31 08 96 DB 73 2A 6D 4A ...f...y1...s*mJ
0001E0 FD 83 E1 6C 38 B0 B4 10 80 B4 71 98 31 4B 35 88 ...l8.....q.1K5.
0001F0 00 5B C0 84 2D 53 9E 2B 0B E1 D5 2A 2D FF 7A F1 .[..-S.+...*-.z.
000200 90 B7 7C 3C 60 B0 73 AF 35 FD 86 23 A4 E8 4F E4 ..|<`.s.5..#..O.
Remote-Local on TCP 2.1
000000 17 03 00 02 71 56 0D EE D8 2F 90 E2 21 B1 93 C5 ....qV.../..!...
000010 55 4D FA 0C 01 BC 85 C6 BE 5F 0A CC 7B 1C 4A 67 UM......._..{.Jg
000020 F1 5A E4 B9 FF B0 43 31 1B 54 62 1B C8 56 06 B6 .Z....C1.Tb..V..
000030 08 0B FB 9D 85 25 7E 44 0F 73 D8 68 08 18 91 9F .....%~D.s.h....
000040 27 6C F4 86 AE AB 16 1B 31 20 2E B2 25 63 28 E5 'l......1 ..%c(.
000050 18 CE 1B FA 3D C4 3B 9C 23 1A 5D B8 8A 29 B0 80 ....=.;.#.]..)..
000060 00 2C 78 ED 2C 99 09 38 05 66 0C 91 C1 46 80 3C .,x.,..8.f...F.<
000070 B4 E5 89 3A 2D 35 94 1C 75 19 67 DB CF 7B A2 F6 ...:-5..u.g..{..
000080 3D 4F B8 BF E2 C7 26 A0 2B 83 B2 4A C1 67 D8 9F =O....&.+..J.g..
000090 1A 8C 50 DA EA 1A FF 13 DE 7A C0 47 75 7E D7 B8 ..P......z.Gu~..
0000A0 76 62 2F BD 40 B9 CA AC ED 71 9C 4D EB 20 FC 77 vb/.@....q.M. .w
0000B0 97 CF 84 BF 1D EA 13 04 59 B8 A1 75 1A 6C 59 F7 ........Y..u.lY.
0000C0 70 C9 95 0B 7C F6 ED 71 C2 09 B9 9A 60 2D 38 BD p...|..q....`-8.
0000D0 20 82 7C 47 AC 23 43 41 74 81 47 DE 80 21 2C 49 .|G.#CAt.G..!,I
0000E0 6D 6E 82 75 C9 37 BA EA F6 DC B0 8C 0F F0 47 C5 mn.u.7........G.
0000F0 56 65 CC 7F 23 6B 11 FC E0 39 46 64 37 2E FC 12 Ve..#k...9Fd7...
000100 54 F9 49 D4 3E 69 FF 4A D3 D5 5F 69 3F 85 EA 19 T.I.>i.J.._i?...
000110 14 34 1C 7C 33 1C F4 14 44 6E 38 33 32 8E E4 48 .4.|3...Dn832..H
000120 35 A6 7D 09 B3 CE BE F9 0A D8 B9 FC E5 E7 86 2B 5.}............+
000130 70 53 61 62 37 94 71 2F C8 50 F3 31 9E 4C 9A D7 pSab7.q/.P.1.L..
000140 E4 39 6C 63 EA FB DA 30 33 C5 54 B9 0F D1 A3 81 .9lc...03.T.....
000150 F2 29 FC 05 6D D7 72 62 EA 88 D2 F4 69 76 40 48 .)..m.rb....iv@H
000160 A4 17 70 B2 31 2A 59 63 C1 40 2A 6A 2C AB 69 D2 ..p.1*Yc.@*j,.i.
000170 F5 AE 42 D8 EA 43 73 A4 DB 4E 58 D1 9D A8 AA AA ..B..Cs..NX.....
000180 CE 15 81 F2 2E 70 37 42 0E A3 67 BF 57 16 4A 29 .....p7B..g.W.J)
000190 5E 80 29 81 90 8B 00 A4 BD 42 5F D2 F2 2C 32 27 ^.)......B_..,2'
0001A0 B8 13 7E EC 9F 55 DE 90 4A E0 FC FF D9 99 D5 97 ..~..U..J.......
0001B0 2C 50 D5 46 4D E9 2F CE E7 D4 63 BB D0 B0 CB D6 ,P.FM./...c.....
0001C0 4B BA 01 5B CA BB 9C 62 CE 4E DF 8E 11 1A 11 DD K..[...b.N......
0001D0 F3 2D 7F 60 4E AA 5D 55 DC 3E 03 83 EA 15 F3 38 .-.`N.]U.>.....8
0001E0 42 0A B0 9F B1 0E 14 F6 2B 3A 89 FA 5D 11 7B ED B.......+:..].{.
0001F0 AA 2D 4A 93 23 57 DE 5C B1 AC 76 99 AC 1F 78 6F .-J.#W.\..v...xo
000200 18 B7 68 CF 85 95 B5 CD 09 C9 5C FC 7C 0D F8 C9 ..h.......\.|...
000210 33 B9 77 93 47 97 51 19 D4 D8 EC 10 FA 3B F8 22 3.w.G.Q......;."
000220 BC 6B 81 44 42 E5 E7 0B AC D1 0C 45 3A FF 2E 1F .k.DB......E:...
000230 CD 83 EB D4 C3 18 DC E7 0B E4 98 8F 90 F2 5B 4C ..............[L
000240 EA 17 D0 2A 2E 84 B9 45 A4 83 A2 98 43 57 B0 39 ...*...E....CW.9
000250 BB AF BA E9 64 A3 5F 3D 8F 17 13 1E D6 C6 09 BB ....d._=........
000260 2B 39 08 AD B5 05 65 58 90 E3 B5 2D 78 E1 6E 96 +9....eX...-x.n.
000270 C7 89 46 B4 30 B4 ..F.0.
remote Close on TCP 2.1
Destroy on TCP 2.1
Request on TCP 4
Connect on TCP 4.1 (gpcm.gs.nintendowifi.net)
Accept on TCP 4.1 (10.0.0.2)
Remote-Local on TCP 4.1
000000 5C 6C 63 5C 31 5C 63 68 61 6C 6C 65 6E 67 65 5C \lc\1\challenge\
000010 4D 43 44 56 57 50 4D 58 43 59 5C 69 64 5C 31 5C MCDVWPMXCY\id\1\
000020 66 69 6E 61 6C 5C final\
Local-Remote on TCP 4.1
000000 5C 6C 6F 67 69 6E 5C 5C 63 68 61 6C 6C 65 6E 67 \login\\challeng
000010 65 5C 78 57 31 43 65 4E 63 44 59 58 52 76 61 50 e\xW1CeNcDYXRvaP
000020 47 64 74 45 6C 42 49 71 41 33 70 6C 6B 75 75 4B GdtElBIqA3plkuuK
000030 4C 42 5C 61 75 74 68 74 6F 6B 65 6E 5C 4E 44 53 LB\authtoken\NDS
000040 72 50 73 77 4F 4B 53 4E 33 49 6B 46 68 73 51 30 rPswOKSN3IkFhsQ0
000050 63 6C 46 75 59 68 7A 4B 73 4F 55 70 62 6D 2B 4C clFuYhzKsOUpbm+L
000060 74 67 4E 66 34 6B 4D 34 6D 68 57 49 4C 70 7A 36 tgNf4kM4mhWILpz6
000070 56 72 57 55 2B 4B 79 56 70 6F 57 44 77 45 58 79 VrWU+KyVpoWDwEXy
000080 59 6D 62 69 65 71 43 44 31 4C 45 52 4F 55 4E 4B YmbieqCD1LEROUNK
000090 59 6B 6B 59 53 68 30 64 75 6C 6C 65 33 47 2B 73 YkkYSh0dulle3G+s
0000A0 73 59 67 76 37 61 69 6B 45 65 6D 52 65 6B 62 52 sYgv7aikEemRekbR
0000B0 2B 33 38 35 65 36 6E 71 75 47 76 77 2F 61 79 41 +385e6nquGvw/ayA
0000C0 5C 72 65 73 70 6F 6E 73 65 5C 61 37 36 31 61 63 \response\a761ac
0000D0 33 62 32 64 61 65 66 31 31 65 37 35 33 33 63 63 3b2daef11e7533cc
0000E0 39 61 38 36 37 32 36 34 63 37 5C 66 69 72 65 77 9a867264c7\firew
0000F0 61 6C 6C 5C 31 5C 70 6F 72 74 5C 30 5C 70 72 6F all\1\port\0\pro
000100 64 75 63 74 69 64 5C 31 30 36 37 31 5C 67 61 6D ductid\10671\gam
000110 65 6E 61 6D 65 5C 6D 70 72 69 6D 65 64 73 5C 6E ename\mprimeds\n
000120 61 6D 65 73 70 61 63 65 69 64 5C 30 5C 69 64 5C amespaceid\0\id\
000130 31 5C 66 69 6E 61 6C 5C 1\final\
Remote-Local on TCP 4.1
000000 5C 6C 63 5C 32 5C 73 65 73 73 6B 65 79 5C 34 37 \lc\2\sesskey\47
000010 34 36 31 37 34 33 5C 70 72 6F 6F 66 5C 37 64 30 461743\proof\7d0
000020 32 36 32 37 32 39 66 35 66 39 66 35 65 61 62 62 262729f5f9f5eabb
000030 31 34 38 64 34 66 62 39 66 35 63 34 31 5C 75 73 148d4fb9f5c41\us
000040 65 72 69 64 5C 35 37 34 31 35 31 30 36 5C 70 72 erid\57415106\pr
000050 6F 66 69 6C 65 69 64 5C 36 37 38 34 37 37 36 38 ofileid\67847768
000060 5C 75 6E 69 71 75 65 6E 69 63 6B 5C 30 39 6F 6C \uniquenick\09ol
000070 64 31 65 62 74 41 4D 48 45 32 35 64 6D 68 6D 6F d1ebtAMHE25dmhmo
000080 5C 6C 74 5C 31 52 31 62 50 71 68 39 65 63 44 39 \lt\1R1bPqh9ecD9
000090 5B 4A 4F 35 66 44 49 55 76 67 5F 5F 5C 69 64 5C [JO5fDIUvg__\id\
0000A0 31 5C 66 69 6E 61 6C 5C 1\final\
Local-Remote on TCP 4.1
000000 5C 73 74 61 74 75 73 5C 31 5C 73 65 73 73 6B 65 \status\1\sesske
000010 79 5C 34 37 34 36 31 37 34 33 5C 73 74 61 74 73 y\47461743\stats
000020 74 72 69 6E 67 5C 5C 6C 6F 63 73 74 72 69 6E 67 tring\\locstring
000030 5C 5C 66 69 6E 61 6C 5C 5C 73 74 61 74 75 73 5C \\final\\status\
000040 31 5C 73 65 73 73 6B 65 79 5C 34 37 34 36 31 37 1\sesskey\474617
000050 34 33 5C 73 74 61 74 73 74 72 69 6E 67 5C 5C 6C 43\statstring\\l
000060 6F 63 73 74 72 69 6E 67 5C 41 67 2A 2A 5C 66 69 ocstring\Ag**\fi
000070 6E 61 6C 5C nal\
Remote-Local on TCP 4.1
000000 5C 62 6D 5C 31 30 30 5C 66 5C 36 37 38 31 31 30 \bm\100\f\678110
000010 38 33 5C 6D 73 67 5C 7C 73 7C 30 7C 73 73 7C 4F 83\msg\|s|0|ss|O
000020 66 66 6C 69 6E 65 5C 66 69 6E 61 6C 5C ffline\final\
Remote-Local on TCP 4.1
000000 5C 62 6D 5C 31 30 30 5C 66 5C 36 38 33 31 39 30 \bm\100\f\683190
000010 32 39 5C 6D 73 67 5C 7C 73 7C 30 7C 73 73 7C 4F 29\msg\|s|0|ss|O
000020 66 66 6C 69 6E 65 5C 66 69 6E 61 6C 5C ffline\final\
Remote-Local on TCP 4.1
000000 5C 62 6D 5C 31 30 30 5C 66 5C 36 38 32 35 32 35 \bm\100\f\682525
000010 34 33 5C 6D 73 67 5C 7C 73 7C 30 7C 73 73 7C 4F 43\msg\|s|0|ss|O
000020 66 66 6C 69 6E 65 5C 66 69 6E 61 6C 5C ffline\final\
Request on TCP 6
Connect on TCP 6.1 (gamestats.gamespy.com)
Accept on TCP 6.1 (10.0.0.2)
Remote-Local on TCP 6.1
000000 1B 0D 0E 39 62 2C 1A 5B 25 2B 0D 08 0B 34 15 25 ...9b,.[%+...4.%
000010 74 12 0A 32 22 26 04 31 30 6A 18 2E 05 31 54 5C t..2"&.10j...1T\
000020 66 69 6E 61 6C 5C final\
Local-Remote on TCP 6.1
000000 1B 00 18 11 3B 2C 25 54 25 2A 04 03 04 3E 15 25 ....;,%T%*...>.%
000010 5E 34 35 08 00 00 37 03 25 41 21 34 11 02 0B 20 ^45...7.%A!4...
000020 15 25 50 27 77 55 5E 54 64 49 49 51 20 73 00 08 .%P'wU^TdIIQ s..
000030 07 37 14 4A 51 71 7E 03 0B 5D 67 42 4F 04 76 24 .7.JQq~..]gBO.v$
000040 02 5D 39 23 1F 0B 47 18 77 3D 04 01 0F 41 5C 66 .]9#..G.w=...A\f
000050 69 6E 61 6C 5C inal\
Remote-Local on TCP 6.1
000000 1B 0D 0E 39 61 2C 0A 56 37 34 0A 08 1C 0F 41 4C ...9a,.V74....AL
000010 04 7D 77 53 59 57 67 45 25 43 36 28 0E 0B 39 63 .}wSYWgE%C6(..9c
000020 2C 10 57 18 76 5C 66 69 6E 61 6C 5C ,.W.v\final\
Local-Remote on TCP 6.1
000000 1B 00 18 11 3B 00 25 6F 25 32 15 05 11 3C 1B 1C ....;.%o%2...<..
000010 5D 18 09 25 3E 17 03 03 0E 7C 0F 14 2F 5E 2C 38 ]..%>....|../^,8
000020 36 11 40 15 77 02 01 23 26 29 11 49 0F 34 2E 38 6.@.w..#&).I.4.8
000030 15 31 1D 52 7F 30 20 2F 0B 51 38 3D 4D 5E 2C 10 .1.R.0 /.Q8=M^,.
000040 28 21 15 29 46 2F 41 13 12 4A 26 1C 05 00 16 64 (!.)F/A..J&....d
000050 00 30 24 35 1C 0A 1D 1B 5A 21 36 22 29 54 1F 35 .0$5....Z!6")T.5
000060 2B 7C 11 09 2A 34 0E 38 29 2A 5B 74 23 14 01 09 +|..*4.8)*[t#...
000070 36 43 3E 18 37 34 38 0A 13 64 11 10 58 01 22 0C 6C>.748..d..X.".
000080 3F 00 38 12 2B 18 77 7F 54 08 53 3D 01 0C 74 32 ?.8.+.w.T.S=..t2
000090 30 4E 0C 1C 12 2C 0B 56 37 37 3D 5C 51 35 43 4A 0N...,.V77=\Q5CJ
0000A0 52 7D 23 00 55 57 61 12 4D 04 7C 24 52 08 57 36 R}#.UWa.M.|$R.W6
0000B0 45 1A 55 72 23 04 54 57 35 46 48 6F 28 2E 05 31 E.Ur#.TW5FHo(..1
0000C0 55 5C 66 69 6E 61 6C 5C U\final\
Remote-Local on TCP 6.1
000000 1B 11 0C 10 27 18 0B 6F 72 70 59 59 52 64 46 41 ....'..orpYYRdFA
000010 6F 28 2E 05 31 55 5C 66 69 6E 61 6C 5C o(..1U\final\
Local-Remote on TCP 6.1
000000 1B 12 08 11 23 14 25 6F 34 2E 05 31 53 64 48 4D ....#.%o4..1SdHM
000010 04 73 71 59 31 15 27 09 09 56 18 74 3D 09 0C 3D .sqY1.'..V.t=..=
000020 14 1C 4B 18 77 3D 06 13 0F 41 25 5F 2D 23 3D 5D ..K.w=...A%_-#=]
000030 39 3F 15 17 54 30 2F 3D 5F 56 60 2C 1D 52 30 26 9?..T0/=_V`,.R0&
000040 3D 31 0B 0F 40 49 07 73 77 51 5A 50 63 40 4E 0A =1..@I.swQZPc@N.
000050 74 77 54 5D 55 63 46 4C 03 74 70 53 5D 55 65 46 twT]UcFL.tpS]UeF
000060 49 03 72 72 51 5D 53 60 40 49 04 70 1B 00 26 39 I.rrQ]S`@I.p..&9
000070 60 48 4A 6F 26 0C 3D 5C 55 62 49 25 57 18 77 3D `HJo&.=\UbI%W.w=
000080 09 26 0F 41 4F 06 74 71 56 5D 54 60 48 25 55 18 .&.AO.tqV]T`H%U.
000090 7E 52 54 5C 62 47 4C 05 7C 1B 06 3D 29 0F 42 4E ~RT\bGL.|..=).BN
0000A0 07 18 20 31 3A 39 62 49 25 5B 17 1B 50 59 56 0F .. 1:9bI%[..PYV.
0000B0 1C 29 67 18 71 53 54 55 64 2C 15 78 08 1B 59 31 .)g.qSTUd,.x..Y1
0000C0 09 18 27 25 04 18 2B 36 21 39 60 46 25 5F 13 10 ..'%..+6!9`F%_..
0000D0 3D 58 39 27 39 48 6F 75 7F 53 5A 54 66 42 25 47 =X9'9Hou.SZTfB%G
0000E0 0D 75 3D 5E 52 64 47 48 00 18 33 28 5E 39 62 44 .u=^RdGH..3(^9bD
0000F0 48 06 74 73 3D 19 2C 67 2C 4C 07 72 75 54 31 11 H.ts=.,g,L.ruT1.
000100 03 3F 25 02 74 7F 57 59 54 0F 04 2A 75 18 75 57 .?%.t.WYT..*u.uW
000110 59 52 67 2C 0E 63 10 1B 56 58 50 62 2C 0E 7F 18 YRg,.c..VXPb,...
000120 75 52 58 39 24 27 25 02 76 47 5C 66 69 6E 61 6C uRX9$'%.vG\final
000130 5C \
Local-Remote on TCP 6.1
000000 1B 06 08 11 23 14 25 6F 34 2E 05 31 53 64 48 48 ....#.%o4..1SdHH
000010 02 74 7F 52 31 15 27 09 09 56 18 74 3D 09 0C 3D .t.R1.'..V.t=..=
000020 14 1C 4B 18 77 3D 06 00 2A 03 25 5D 45 26 2A 6C ..K.w=..*.%]E&*l
000030 07 18 71 1D 32 20 04 60 0B 64 34 20 35 32 23 17 ..q.2 .`.d4 52#.
000040 36 6C 0D 00 71 15 63 10 46 0D 26 29 52 1C 32 64 6l..q.c.F.&)R.2d
000050 45 2B 36 21 64 3F 27 2E 32 30 0E 50 6C 11 1A 42 E+6!d?'.20.Pl..B
000060 78 47 0D 74 60 19 2C 67 71 0D 63 0B 46 15 3E 23 xG.t`.,gq.c.F.>#
000070 52 07 29 67 45 30 2D 6C 12 04 2C 15 5A 20 1B 51 R.)gE0-l..,.Z .Q
000080 5C 66 69 6E 61 6C 5C \final\
Local-Remote on TCP 6.1
000000 1B 06 08 11 23 14 25 6F 34 2E 05 31 53 6B 43 48 ....#.%o4..1SkCH
000010 0A 74 75 58 31 15 27 09 09 56 18 74 3D 09 0C 3D .tuX1.'..V.t=..=
000020 14 1C 4B 18 77 3D 06 00 2A 03 25 5D 45 26 2A 6C ..K.w=..*.%]E&*l
000030 07 18 71 1D 32 20 04 60 0B 64 34 20 35 32 23 17 ..q.2 .`.d4 52#.
000040 36 6C 0D 00 71 15 63 10 46 0D 26 29 52 1C 32 64 6l..q.c.F.&)R.2d
000050 45 2B 36 21 64 3F 27 2E 32 30 0E 50 6C 11 1A 42 E+6!d?'.20.Pl..B
000060 78 47 0D 74 60 19 2C 67 71 0D 63 0B 46 15 3E 23 xG.t`.,gq.c.F.>#
000070 52 07 29 67 45 30 2D 6C 12 04 2C 15 5A 20 1B 51 R.)gE0-l..,.Z .Q
000080 5C 66 69 6E 61 6C 5C \final\
Local-Remote on TCP 6.1
000000 1B 06 08 11 23 14 25 6F 34 2E 05 31 53 6B 42 4C ....#.%o4..1SkBL
000010 01 71 73 52 31 15 27 09 09 56 18 74 3D 09 0C 3D .qsR1.'..V.t=..=
000020 14 1C 4B 18 77 3D 06 00 2A 03 25 5D 45 26 2A 6C ..K.w=..*.%]E&*l
000030 07 18 71 1D 32 20 04 60 0B 64 34 20 35 32 23 17 ..q.2 .`.d4 52#.
000040 36 6C 0D 00 71 15 63 10 46 0D 26 29 52 1C 32 64 6l..q.c.F.&)R.2d
000050 45 2B 36 21 64 3F 27 2E 32 30 0E 50 6C 11 1A 42 E+6!d?'.20.Pl..B
000060 78 47 0D 74 60 19 2C 67 71 0D 63 0B 46 15 3E 23 xG.t`.,gq.c.F.>#
000070 52 07 29 67 45 30 2D 6C 12 04 2C 15 5A 20 1B 51 R.)gE0-l..,.Z .Q
000080 5C 66 69 6E 61 6C 5C \final\
Remote-Local on TCP 6.1
000000 1B 12 08 11 23 14 0B 6F 75 1B 0D 04 01 0F 40 25 ....#..ou.....@%
000010 43 2D 23 3D 5B 52 6B 44 4E 04 72 7F 3D 00 0A 37 C-#=[RkDN.r.=..7
000020 2C 48 02 70 7F 54 5D 57 62 41 49 5C 66 69 6E 61 ,H.p.T]WbAI\fina
000030 6C 5C l\
Remote-Local on TCP 6.1
000000 1B 06 08 11 23 14 0B 6F 75 1B 0D 04 01 0F 40 25 ....#..ou.....@%
000010 43 2D 23 3D 5B 52 6B 41 48 03 7C 74 3D 00 0A 37 C-#=[RkAH.|t=..7
000020 2C 48 02 70 72 54 5A 5C 6B 40 4A 6F 28 22 0F 0A ,H.prTZ\k@Jo("..
000030 11 3B 2C 4B 01 75 1B 05 0C 11 32 2C 25 5D 18 77 .;,K.u....2,%].w
000040 51 59 01 63 40 4F 02 74 77 56 5E 55 63 46 1F 03 QY.c@O.twV^UcF..
000050 74 71 04 5D 55 61 40 49 03 70 72 51 5D 51 37 40 tq.]Ua@I.prQ]Q7@
000060 49 00 7D 77 51 5E 5C 0F 07 35 6F 72 71 3D 1A 35 I.}wQ^\..5orq=.5
000070 07 2C 48 01 70 74 50 31 09 18 27 25 05 18 30 36 .,H.ptP1..'%..06
000080 31 5D 0F 1C 32 7F 18 75 55 31 07 18 2C 4C 00 72 1]..2..uU1..,L.r
000090 1B 05 2E 39 66 47 4D 03 74 77 54 5F 5C 0F 16 25 ...9fGM.twT_\..%
0000A0 01 73 75 57 5B 56 61 40 49 6F 20 1B 50 31 11 00 .suW[Va@Io .P1..
0000B0 36 25 02 73 71 51 5A 39 27 20 36 6F 77 70 59 5B 6%.sqQZ9' 6owpY[
0000C0 5D 0F 17 29 7F 18 71 59 31 04 18 2C 4C 00 18 2B ]..)..qY1..,L..+
0000D0 36 21 39 65 45 25 5F 14 13 3D 5C 54 6A 47 41 6F 6!9eE%_..=\TjGAo
0000E0 28 10 36 31 51 0F 17 29 64 18 75 59 31 0D 00 2C (.61Q..)d.uY1..,
0000F0 48 0A 73 1B 15 24 51 0F 40 25 47 0D 74 3D 59 5D H.s..$Q.@%G.t=Y]
000100 64 42 41 6F 30 0E 53 31 57 63 45 4C 00 76 1B 15 dBAo0.S1WcEL.v..
000110 24 54 0F 44 4E 04 74 74 50 5C 66 69 6E 61 6C 5C $T.DN.ttP\final\
000120 1B 06 08 11 23 14 0B 6F 75 1B 0D 04 01 0F 40 25 ....#..ou.....@%
000130 43 2D 23 3D 5B 5D 60 41 40 03 76 7E 3D 00 0A 37 C-#=[]`A@.v~=..7
000140 2C 48 02 70 7F 52 5F 57 6A 46 4C 6F 28 22 0F 0A ,H.p.R_WjFLo("..
000150 11 3B 2C 4B 03 71 1B 05 0C 11 32 2C 25 5D 18 77 .;,K.q....2,%].w
000160 51 5B 50 63 40 4C 0B 74 77 57 54 55 63 47 4A 03 Q[Pc@L.twWTUcGJ.
000170 74 70 55 5D 55 65 45 49 03 72 22 51 5D 50 32 2C tpU]UeEI.r"Q]P2,
000180 0E 7F 18 72 3D 1A 35 07 2C 4F 01 7D 71 3D 01 2E ...r=.5.,O.}q=..
000190 04 2C 4F 6F 33 10 3D 59 39 3F 3B 35 6F 73 1B 03 .,Oo3.=Y9?;5os..
0001A0 26 39 64 47 25 57 07 1B 50 5B 50 65 49 4E 01 74 &9dG%W..P[PeIN.t
0001B0 75 3D 0B 39 6B 40 4C 05 72 71 59 5C 53 0F 14 25 u=.9k@L.rqY\S..%
0001C0 02 18 33 32 2B 39 65 49 49 01 18 33 31 22 39 62 ..32+9eII..31"9b
0001D0 44 4B 06 71 1B 06 3D 29 0F 45 25 52 0F 1B 51 31 DK.q..=).E%R..Q1
0001E0 09 04 3C 25 06 18 2B 31 39 39 62 41 4B 03 18 2B ..<%..+199bAK..+
0001F0 36 3A 39 61 2C 1E 63 13 1B 50 55 39 3B 23 25 06 6:9a,.c..PU9;#%.
000200 18 33 28 59 39 62 40 4A 03 76 1B 15 24 56 0F 43 .3(Y9b@J.v..$V.C
000210 4E 06 70 7F 3D 19 2C 61 2C 4F 07 74 73 53 31 11 N.p.=.,a,O.tsS1.
000220 1A 41 25 02 74 7E 51 5B 52 5C 66 69 6E 61 6C 5C .A%.t~Q[R\final\
000230 1B 06 08 11 23 14 0B 6F 75 1B 0D 04 01 0F 40 25 ....#..ou.....@%
000240 43 2D 23 3D 5B 5D 61 45 4B 06 70 74 3D 00 0A 37 C-#=[]aEK.pt=..7
000250 2C 48 02 70 7F 55 5E 50 62 41 4B 6F 28 22 0F 0A ,H.p.U^PbAKo("..
000260 11 3B 2C 4B 00 75 1B 05 0C 11 32 2C 25 5D 18 77 .;,K.u....2,%].w
000270 51 59 57 63 40 4F 06 74 77 57 0B 55 63 44 48 03 QYWc@O.twW.UcDH.
000280 74 71 52 5D 55 65 45 49 03 76 77 51 5D 51 61 40 tqR]UeEI.vwQ]Qa@
000290 49 07 70 77 51 59 56 0F 07 35 6F 75 75 58 31 12 I.pwQYV..5ouuX1.
0002A0 03 24 25 01 77 75 50 55 39 3F 3B 2E 6F 73 1B 16 .$%.wuPU9?;.os..
0002B0 3A 39 61 40 25 5F 0F 0B 3D 5C 57 0F 12 32 6F 71 :9a@%_..=\W..2oq
0002C0 7F 54 31 01 10 2C 4B 02 77 70 52 5B 52 62 40 4E .T1..,K.wpR[Rb@N
0002D0 6F 22 1B 53 5E 54 65 47 4D 03 7C 1B 05 31 50 0F o".S^TeGM.|..1P.
0002E0 04 2A 75 18 73 57 54 56 67 2C 0D 63 0B 1B 50 5E .*u.sWTVg,.c..P^
0002F0 51 62 45 4E 6F 23 17 2D 31 54 6A 40 25 52 0F 1B QbENo#.-1Tj@%R..
000300 50 5A 57 0F 1C 2E 7F 18 72 50 31 09 03 24 25 04 PZW.....rP1..$%.
000310 71 72 51 59 39 3F 27 2E 6F 71 1B 06 3D 32 0F 46 qrQY9?'.oq..=2.F
000320 4C 6F 2C 14 3D 54 55 0F 04 30 07 18 71 52 5D 51 Lo,.=TU..0..qR]Q
000330 6B 2C 0D 7A 77 1B 50 5D 5C 61 48 4A 6F 30 0E 53 k,.zw.P]\aHJo0.S
000340 31 5C 63 46 4F 07 74 1B 15 24 54 0F 41 41 06 75 1\cFO.t..$T.AA.u
000350 7E 52 58 5C 66 69 6E 61 6C 5C ~RX\final\
Local-Remote on TCP 4.1
000000 5C 73 74 61 74 75 73 5C 31 5C 73 65 73 73 6B 65 \status\1\sesske
000010 79 5C 34 37 34 36 31 37 34 33 5C 73 74 61 74 73 y\47461743\stats
000020 74 72 69 6E 67 5C 5C 6C 6F 63 73 74 72 69 6E 67 tring\\locstring
000030 5C 41 41 2A 2A 5C 66 69 6E 61 6C 5C \AA**\final\
Local Close on TCP 6.1
Destroy on TCP 6.1
Local-Remote on TCP 4.1
000000 5C 6C 6F 67 6F 75 74 5C 5C 73 65 73 73 6B 65 79 \logout\\sesskey
000010 5C 34 37 34 36 31 37 34 33 5C 66 69 6E 61 6C 5C \47461743\final\
Local Close on TCP 4.1
Destroy on TCP 4.1 |
| Thread closed
