pkmn-classic-framework icon indicating copy to clipboard operation
pkmn-classic-framework copied to clipboard

Implement Game Sync

Open mm201 opened this issue 10 years ago • 62 comments

@polaris- already did some amazing work reverse engineering this; I should be able to do the rest myself.

Note that I have no plans of replicating the original dream world, since that would be a major violation of copyright.

mm201 avatar Sep 07 '14 00:09 mm201

what's news ? and for fixing the Matchmaking of gen5 random matchups ?

ghost avatar Jun 15 '15 16:06 ghost

I need lots of free time to do game Sync. Random matchup is an altwfc issue. Send them your packets.

https://github.com/polaris-/dwc_network_server_emulator/issues/162

mm201 avatar Jun 15 '15 17:06 mm201

Random bump; @mm201 how is the stage of the framework as a whole?

ghost avatar Jun 05 '16 22:06 ghost

It'll be done when it's ready.

mm201 avatar Jul 26 '16 20:07 mm201

What are you planning to do with the whole dream world/ global link stuff then i know you won't replicate it but what are you going to use the gamesync for and what will happen to all the other functions of gamesync will you work with other's to create a way to grow berries and maybe get dream world event pokemon or something like that and do you have any plans for the other global link stuff

dmoeenm avatar Sep 16 '16 23:09 dmoeenm

any news ?

the4anoni avatar Jan 01 '17 11:01 the4anoni

Well ofc not. If there was any news, it'd have been posted :wink:

ghost avatar Jan 01 '17 15:01 ghost

How can i help with this ? (im not dev ,dont have any captured packages)

the4anoni avatar Jan 02 '17 16:01 the4anoni

Could you write up what you do know about the Game Sync protocol? The lay writeups focus on the Dream World (not unreasonable, but unhelpful for our purposes) and I'd be interested to know what uses it can be put to.

ketsuban avatar Jul 23 '17 02:07 ketsuban

First, the game checks the account status. If it's able to put a pokemon to bed, it first downloads a banlist, then lets you pick a pokemon, then puts it to bed. The put-to-bed request actually uploads the entire savefile to the server. Another possible account status is that the pokemon is dreaming or that it's able to wake up. If you wake it up, the server sends a payload which contains any pokemon or items you brought back with you. Communications happen over https. It's not a gamestats server.

There should be other stuff in this payload I haven't had a chance to look at yet, such as trainer's pokemon who visited you and stuff for BW2 join avenue.

The neatest thing is that the entire savefile is sent, so this can be used for stuff like bulk IV checking. You should also be able to inject pokemon, which will then appear in the forest to be caught with dream balls, or items.

I can't give you detailed specifics, since I haven't figured them out yet and plan on figuring them out by actually implementing it. What I can provide is @polaris- 's toy Game Sync implementation which contains some valuable research he did.

mm201 avatar Jul 24 '17 13:07 mm201

Wow, that's a lot more exploitable than what I was expecting. Thanks!

ketsuban avatar Jul 24 '17 16:07 ketsuban

How is the project going?

ghost avatar Jul 07 '18 16:07 ghost

Yo, incase you need any help, I've been doing some research relating to Game Sync. I've built a simple Python server to run GS but that's besides the point. Currently I've found that when a Pokemon isn't currently sleeping in that save, returning anything relating to waking up a Pokemon will tell you that "Game Sync needs to recharge"

zurgeg avatar Oct 02 '21 19:10 zurgeg

Alright, more research, the form data (I think?) when you respond with \x08 to playstatus, then with \x00\x00\x00\x00 to account.create.upload, is actually just your raw save data

zurgeg avatar Oct 03 '21 13:10 zurgeg

@zurgeg I hear you're doing some good research! savedata.download is the current snag. Rating battle, i.e. worldbattle download/upload would also be great to have and we should be able to run rating battles without any copyright issue.

Can I contact you on Discord?

mm201 avatar Oct 07 '21 19:10 mm201

@zurgeg I hear you're doing some good research! savedata.download is the current snag. Rating battle, i.e. worldbattle download/upload would also be great to have and we should be able to run rating battles without any copyright issue.

Can I contact you on Discord?

Yeah, but I prefer GitHub issues for this kinda thing ;)

zurgeg avatar Oct 07 '21 19:10 zurgeg

@mm201 I figured out some likely key info on savedata.download

During savedata.download, it runs the following math function 10 times, increasing x each time: f[x] = (x * 0x08) + 0x04, each time it runs that function, it checks the 2 bytes at that location in the response, if those are \x00\x00 then break the loop, otherwise if d <= 0x1ed where D is the data just pulled, then do something(!)

I believe that d is likely pointing to something in the response, from what I saw on polaris-'s gist. I can't seem to find much else at the address (21D7E78) polaris mentioned in the gist.

zurgeg avatar Oct 08 '21 23:10 zurgeg

0x1ed is Arceus's Nat Dex number which is ... interesting. It looks pretty clearly like a null-terminated list of up to 10 whatsits involving Pokémon. Possibly the list of Pokémon to send to the Entree? 8 bytes would give us 4 shorts for species, 2 moves, and maybe some additional flags like gender? But I'm not sure why it would care whether the Pokémon is a Unova native or not. 0x289 seems like a more reasonable number to test.

mm201 avatar Oct 10 '21 03:10 mm201

0x1ed is Arceus's Nat Dex number which is ... interesting. It looks pretty clearly like a null-terminated list of up to 10 whatsits involving Pokémon. Possibly the list of Pokémon to send to the Entree? 8 bytes would give us 4 shorts for species, 2 moves, and maybe some additional flags like gender? But I'm not sure why it would care whether the Pokémon is a Unova native or not. 0x289 seems like a more reasonable number to test.

Odd, afaik Arceus isn't the last guy in the natdex (at least in gen 5). Additionally, PKHeX says that Entree pokemon can only have 1 move? Maybe the additional flags are actually replacing the PID? I know Entree pokemon don't have a PID. EDIT: I did just realize that Arceus is the last guy in the Gen4 dex however.

zurgeg avatar Oct 10 '21 13:10 zurgeg

Heyo, someone else who would be interested in helping out (but not sure how to) here! Took a look at everything mentioned in here so far, as well as the gist shared, and wanted to share my thoughts on it. Please note that I have never played PDW or used the Global Link extensively while it was around, so I might be completely wrong here.

Assuming that the gist was based off of the first set of gen V games (this would somewhat explain why the second loop uses the index of the first BW2 exclusive item), it would make sense for the game to check for any non-Unova Pokémon, as they aren't part of the regional dex. My guess is that the game performs an additional check on non-Unova Pokémon to see whether or not the player has obtained the national dex mode in-game, and if not, makes the Pokémon invisible in the Entree Forest (this is also an option in PKHeX) until they do.

As for the data itself, my guess is that it's laid out like this:

0x00 - 2 bytes - Internal Pokémon ID
0x02 - 2 bytes - First move ID
0x04 - 4 bytes - (Partial) personality value

The DW Pokémon have a set gender, as well as a guaranteed HA (if the Pokémon has one) and cannot be shiny from what I've read, so for these elements, a (partial) personality value would need to be created on the server's side before the transfer occurs (probably within the DW game when the Pokémon was encountered).

Hope any of this helps!

426C7565 avatar Oct 11 '21 09:10 426C7565

Heyo, someone else who would be interested in helping out (but not sure how to) here! Took a look at everything mentioned in here so far, as well as the gist shared, and wanted to share my thoughts on it. Please note that I have never played PDW or used the Global Link extensively while it was around, so I might be completely wrong here.

Assuming that the gist was based off of the first set of gen V games (this would somewhat explain why the second loop uses the index of the first BW2 exclusive item), it would make sense for the game to check for any non-Unova Pokémon, as they aren't part of the regional dex. My guess is that the game performs an additional check on non-Unova Pokémon to see whether or not the player has obtained the national dex mode in-game, and if not, makes the Pokémon invisible in the Entree Forest (this is also an option in PKHeX) until they do.

As for the data itself, my guess is that it's laid out like this:

0x00 - 2 bytes - Internal Pokémon ID
0x02 - 2 bytes - First move ID
0x04 - 4 bytes - (Partial) personality value

The DW Pokémon have a set gender, as well as a guaranteed HA (if the Pokémon has one) and cannot be shiny from what I've read, so for these elements, a (partial) personality value would need to be created on the server's side before the transfer occurs (probably within the DW game when the Pokémon was encountered).

Hope any of this helps!

Ah. Perfect! I used up my GS energy yesterday so I should be able to give this a test. I'll edit this once I do. EDIT: Nope, didn't work. I can't think of anything else that could go on...

zurgeg avatar Oct 11 '21 12:10 zurgeg

Does the problem originate from the Pokémon data parsing specifically, or can it be any of the other sections as well? And is what is described in the gist all that is sent, or is there more data (namely PGL stuff) that is sent in the same response? Supposedly there should be more data that the system receives once a Pokémon wakes up, but I can't find any mention of anything unrelated to the DW apart from the battle competition.

Also, would it be possible to share some snippets of the disassembled code that parses the response, or does that go against any rules/guidelines (not familiar with the legal side of these things)? I don't have any experience in the field reverse-engineering, but would like to take a look at it if possible.

426C7565 avatar Oct 11 '21 14:10 426C7565

Does the problem originate from the Pokémon data parsing specifically, or can it be any of the other sections as well? And is what is described in the gist all that is sent, or is there more data (namely PGL stuff) that is sent in the same response? Supposedly there should be more data that the system receives once a Pokémon wakes up, but I can't find any mention of anything unrelated to the DW apart from the battle competition.

Also, would it be possible to share some snippets of the disassembled code that parses the response, or does that go against any rules/guidelines (not familiar with the legal side of these things)? I don't have any experience in the field reverse-engineering, but would like to take a look at it if possible.

Good question! I haven't taken a look in a debugger since I can't get it to work under melonDS, but I will once I get back to you

zurgeg avatar Oct 11 '21 14:10 zurgeg

Woah! @426C7565 Thank you soooo much! It actually worked! Only problem is... when entering 3rd right (the entralink area where it is), the game crashes! Must be an issue with my code

zurgeg avatar Oct 11 '21 14:10 zurgeg

That's amazing news, congrats! I'm assuming you mean the Entree forest? If so, it might be corrupted Pokémon data. Maybe try and see if manipulating the Pokémon in a save/hex editor (editing it's personality data, replacing/removing it) allows you to enter the zone

426C7565 avatar Oct 11 '21 15:10 426C7565

That's amazing news, congrats! I'm assuming you mean the Entree forest? If so, it might be corrupted Pokémon data. Maybe try and see if manipulating the Pokémon in a save/hex editor (editing it's personality data, replacing/removing it) allows you to enter the zone

Oddly enough, I went there in PKHeX, nothing in the 3rd right?

zurgeg avatar Oct 11 '21 15:10 zurgeg

Hm, what about opening up the save file in a hex editor? The offset for DW Pokémon should be 0x22C00 (as shown on ProjectPokémon). Maybe there's some corrupted data somewhere in that segment and PKHeX just skips over it entirely because of it

426C7565 avatar Oct 11 '21 15:10 426C7565

Hm, what about opening up the save file in a hex editor? The offset for DW Pokémon should be 0x22C00 (as shown on ProjectPokémon). Maybe there's some corrupted data somewhere in that segment and PKHeX just skips over it entirely because of it

Turns out that data was actually item related :P

zurgeg avatar Oct 12 '21 00:10 zurgeg

Turns out that data was actually item related :P

Which data are you referring to here? I'm not sure I completely follow anymore... If you were referring to the data block I mentioned in my previous comment, looking at the way PKHeX parses it confirms that it consists of 530 4-byte long Pokémon entries, followed by some flags and an encryption seed. If not, what exactly is it that you were referring to?

426C7565 avatar Oct 12 '21 11:10 426C7565

Turns out that data was actually item related :P

Which data are you referring to here? I'm not sure I completely follow anymore... If you were referring to the data block I mentioned in my previous comment, looking at the way PKHeX parses it confirms that it consists of 530 4-byte long Pokémon entries, followed by some flags and an encryption seed. If not, what exactly is it that you were referring to?

Exactly. The data block you mentioned actually had to do with items. It seems we can send up to 10 Pokemon and 10 items. The Pokemon block I haven't figured out yet.

zurgeg avatar Oct 12 '21 13:10 zurgeg