more fiddling (found plain text!)

6 files changed, 48 insertions, 34 deletions

diff --git a/assets/melon_1714483602.pcap b/assets/melon_1714483602.pcap
new file mode 100644
index 0000000..5fa4d29
--- /dev/null
+++ b/assets/melon_1714483602.pcap
diff --git a/assets/ws-no-encrypt.png b/assets/ws-no-encrypt.png
new file mode 100644
index 0000000..fb0c0d8
--- /dev/null
+++ b/assets/ws-no-encrypt.png
diff --git a/docs/notes.md b/docs/notes.md
index 6043bfa..21eef78 100644
--- a/docs/notes.md
+++ b/docs/notes.md
@@ -87,4 +87,10 @@ source: <https://git.pipeframe.xyz/fork/melonDS>
 - comment @ src/Wifi.cpp:46 "multiplayer host TX sequence"
 - references to `RFTransfer_Type{2,3}` @ <https://www.problemkaputt.de/gbatek.htm#dswifirfchip>
 - nintendo ds ni-fi protocol @ <https://web.archive.org/web/20090202194241/http://masscat.afraid.org/ninds/proto_info.php>
+- melonDS emulates actual 802.11b frames
+- the protocol does not appear to be encrypted:
+  ![](../assets/ws-no-encrypt.png)
+  the string `lork` is visible as plain text in the hexdump (offset 0x0056), which appears to
+  be some kind of 16-bit encoding of the username set on the emulator used to
+  capture these packets
 
diff --git a/wireshark/nifi-dissect.lua b/wireshark/nifi-dissect.lua
deleted file mode 100644
index 98520e5..0000000
--- a/wireshark/nifi-dissect.lua
+++ /dev/null
@@ -1,32 +0,0 @@
-proto = Proto("NIFI", "Nintendo DS ni-fi")
-
-MAGIC = ProtoField.uint32("nifi.magic", "Magic", base.HEX)
-SENDERID = ProtoField.int32("nifi.senderid", "SenderID", base.DEC)
-TYPE = ProtoField.uint32("nifi.type", "Type", base.DEC)
-LENGTH = ProtoField.uint32("nifi.length", "Length", base.DEC)
-TIMESTAMP = ProtoField.uint64("nifi.timestamp", "Timestamp", base.DEC)
-
-proto.fields = {
-	MAGIC,
-	SENDERID,
-	TYPE,
-	LENGTH,
-	TIMESTAMP,
-}
-
-function proto.dissector(buffer, pinfo, tree)
-	-- check magic ("NIFI")
-	if buffer(0, 4):uint() ~= 0x4e494649 then return end
-
-	pinfo.cols.protocol = proto.name
-
-	local subtree = tree:add(proto, buffer(), "Ni-Fi data")
-
-	subtree:add(MAGIC, buffer(0, 4))
-	subtree:add_le(SENDERID, buffer(4, 4))
-	pinfo.cols.src = tostring(buffer(4, 4):le_int())
-	subtree:add_le(TYPE, buffer(8, 4))
-	subtree:add_le(LENGTH, buffer(12, 4))
-	subtree:add_le(TIMESTAMP, buffer(16, 8))
-end
-
diff --git a/wireshark/nifi.lua b/wireshark/nifi.lua
new file mode 100644
index 0000000..d81ff31
--- /dev/null
+++ b/wireshark/nifi.lua
@@ -0,0 +1,40 @@
+-- NOTE: my system is little-endian, so the .pcap files and this decoder expect
+-- little endian
+
+local nifi = Proto("nifi", "Nintendo DS ni-fi")
+nifi.fields.magic = ProtoField.uint32("nifi.magic", "Magic", base.HEX)
+nifi.fields.senderid = ProtoField.int32("nifi.senderid", "SenderID", base.DEC)
+nifi.fields.type = ProtoField.new("Type", "nifi.type", ftypes.UINT32)
+nifi.fields.type_enum = ProtoField.uint16("nifi.type.enum", "Numeric message type enum", base.DEC, {
+	[0] = "Regular",
+	[1] = "CMD",
+	[2] = "Reply",
+	[3] = "ACK",
+})
+nifi.fields.type_aid = ProtoField.uint16("nifi.type.aid", "Message type \"aid\" value")
+nifi.fields.length = ProtoField.uint32("nifi.length", "Length", base.DEC)
+nifi.fields.timestamp = ProtoField.uint64("nifi.timestamp", "Timestamp", base.DEC)
+
+local nifi_senderid_field = Field.new("nifi.senderid")
+local nifi_type_enum_field = Field.new("nifi.type.enum")
+
+function nifi.dissector(buffer, pinfo, tree)
+	-- check magic ("NIFI")
+	if buffer(0, 4):uint() ~= 0x4e494649 then return end
+	local nifi_tree = tree:add(nifi, buffer(), "Ni-Fi data")
+	nifi_tree:add(nifi.fields.magic, buffer(0, 4))
+
+	nifi_tree:add_le(nifi.fields.senderid, buffer(4, 4))
+
+	local nifi_type_tree = nifi_tree:add_le(nifi.fields.type, buffer(8, 4))
+		nifi_type_tree:add_le(nifi.fields.type_enum, buffer(8, 2))
+		nifi_type_tree:add_le(nifi.fields.type_aid, buffer(10, 2))
+
+	nifi_tree:add_le(nifi.fields.length, buffer(12, 4))
+	nifi_tree:add_le(nifi.fields.timestamp, buffer(16, 8))
+
+	pinfo.cols.protocol = nifi.name
+	pinfo.cols.src = nifi_senderid_field().display
+	pinfo.cols.info = "type:" .. nifi_type_enum_field().display
+end
+
diff --git a/wireshark/wireshark b/wireshark/wireshark
index b871ea3..42c37a5 100755
--- a/wireshark/wireshark
+++ b/wireshark/wireshark
@@ -1,5 +1,5 @@
 #!/bin/sh
-# simple wrapper to load nifi-dissect script as DLT_USER0 dissecter
+# simple wrapper to load nifi.lua script as DLT_USER0 dissecter
 here="$(dirname "$0")"
-exec wireshark -X "lua_script:$here/nifi-dissect.lua" -o 'uat:user_dlts:"User 0 (DLT=147)","nifi","","","",""' "$@"
+exec wireshark -X "lua_script:$here/nifi.lua" -o 'uat:user_dlts:"User 0 (DLT=147)","nifi","","","",""' "$@"