Nintendo Zone

Nintendo Zone

Nintendo Zone is the successor to DS Download Stations, offering retailer exclusive content, game videos, screenshots, etc. As of February 6th 2012 demos are available for download, demos are downloaded from the eShop servers and installed to SD card. NZone demos are the same ones available on eShop, these are region-locked as trying to download them from other regions results in an error. The 3DS NZone is significantly different from the DS(i) πŸ”— NZone. Most content available at NZone is already available on eShop, like the screenshots/videos, game info etc.

Like DSi, when an open 3DS detects NZone the originally hidden NZone title appears and a notification about it appears. Like DSi this title is already stored on NAND, originally this title only became accessible from home-menu once the 3DS was in a range of a NZone at least once, however at some point with a system update this title became always-accessible. When NZone beacons are in range, 3DS only detects NZone when not connected to Internet already. Once connected to a NZone AP, the beacon payload is cached until disconnected from the AP.

When modified DSi nzone beacons are broadcasted with the 3DS Best Buy ApNum, DSi launcher won’t blink the NZone title icon but the title will still semi-work. The NZone application would connect to the server, with buttons for demos, Best Buy, and WFC config displayed, but NZone will display an error a while after selecting “Best Buy” service after a bit of loading.(probably unsupported html tags etc)

Description #

The NZone browser interface is similar to the regular Internet Browser, the browser engine used here is completely different however. Unlike the regular Internet Browser which uses the socket/SSL services directly, the Nintendo Zone application uses the HTTP service instead. 3D stereoscopic videos are supported via html <media> tags, for 3D videos the “mediatype” attribute is set to “3D”. For 2D videos videos the “mediatype” attribute is set to “2D”. This uses Mobiclip with file extension .moflex, the magic number from the first word in the video file is 0xabaa324c(little-endian).

The 3DS NZone application immediately uses NIMS:CheckSysupdateAvailableSOAP once connected to the NZone AP, if an update is available and the user selects “Cancel” in the displayed dialog, the application will stop using the wifi AP.

The user-agent used by the Nintendo Zone application is “NintendoZoneViewer/3.1”. The URL parameters sent to the dsdl.* HTTPS server are the same as DSi(besides the value of the console-type parameter and the “ver” parameter value), except 3DS also sends additional headers in the request using the same data sent in the URL parameters. The zonebnr server requires three more request headers(extra URL parameters are not needed here), the first of these three headers is “ZoneUserID” where the unknown value is 16 hex-digits(8-bytes in binary). The last two headers of these additional three headers contain data which was originally sent with the dsdl server URL parameters.

The NZone beacon encryption is same as before, except some unknown fields in the cleartext was changed where 3DS will only “detect” NZone /w NZone icon blinking/enabled when the beacons’ fields are set this way. DSi will not detect these beacons. 3DS can use DS(i) NZone, but only if the NZone title is already enabled. With DS(i) beacons, 3DS connects to Internet but the NZone icon will not blink. However the NZone title will still work once launched.

Beacon payload format #

This seems to be identical to DS(i) NZone format except for the unknown fields. 3DS NZone is not region-locked like DS(i).

OFFSETSIZEDESCRIPTION
0x0032AP SSID
0x2010ApNum, required for connecting to the server. This is used by the server to determine which retailer NZone you're using. Apnum structure: 10 digits or RSSCCTTLLL. R is the decimal region, SS is the decimal ServiceID. CC is the two-letter country-code, TT is the 2-letter country state/province code, and LLL is the decimal locationID. Regions: 0) JPN 1) USA 2/3) EUR 4) KOR 5) CHN. LLL is always zero for non-JPN deployments, however in JPN this is unique per NZone hotspot location.
0x2a2This u16 was always one in all dumps, unknown what this is. This isn't used by the client.
0x2c24Some ServiceName, either in UTF-16 or ASCII
0x4432AP crypto key, if any
0x641Unknown, not used by the DS(i) client. For 3DS this value varies, for DS(i) this is 0x0.
0x651AP crypto key type: 0) Open 1) WEP-64 2) WEP-128 3) WEP-152 4) WPA-PSK (TKIP) 5) WPA2-PSK (TKIP) 6) WPA-PSK (AES) 7) WPA2-PSK (AES) (the encryption key field contains the AP passphrase)
0x661Bit 0: Enables Nintendo Zone content on DS(i)
Bit 1: Enables friend list and online gaming
Bit 4: Enables Nintendo Zone Viewer on 3DS
Bit 7: Blocks the Nintendo eShop
Bits 2, 3, 5, 6: Unknown
0x671Bit 0: Blocks the internet browser
Bits 1 to 7: Unknown
0x684Padding
0x6c2Unknown, seems to be always 0x428
0x6e2CRC16 over the whole payload excluding CRC offset, initval is 0

Wi-Fi Hotspots #

Hotspot.conf format #

The list of NZone hotspots is loaded from “conf:/hotspot.conf” by the AC system applet, where “conf:” is the 000400DB00010502 CFA archive. This is a CSV file, with LF-style newlines. All of the information stored in the NZone beacon is also stored in this file for each hotspot. This file can list a max of 100 hotspots.(As of title version v1024, hotspot.conf lists 52 hotspots) This format can be parsed by πŸ”— hotspotconf-tool.

Beginning the CSV file is the Interval record and field. Following that is the hotspot records on one line, and the fields for each hotspot on individual lines. Some fields are Base64-encoded, for those the Base64 padding character ‘*’ is used instead of ‘=’.

IsBrowser, IsShop, and IsGame might determine whether the Internet Browser, eShop, and games’ online multi-player may be used.

Records #

Record nameField max lenField data
IntervalArbitraryDecimal interval, unknown (usually 20)
ServiceName0x40 (after decode)Hotspot Base64-encoded ASCII ServiceName
Url0x80 (after decode)Hotspot Base64-encoded URL (usually unused, optionally links to the retailer’s website)
Ssid32 (after decode)Hotspot Base64-encoded SSID
SecurityKey0x40 (after decode)Hotspot Base64-encoded encryption key. For encryption type7, WPA2-PSK is used, however unlike the NZone beacon this is the 0x20-byte WPA-PSK.
SecurityMode1Decimal hotspot encryption type (0 for none)
ApNum10Hotspot ApNum, see above NZone beacon info
IsVendorIE1Decimal hotspot flag, can be either 1 or 0
IsBackground1Decimal hotspot flag, can be either 1 or 0
IsBrowser1Decimal hotspot flag, can be either 1 or 0
IsShop1Decimal hotspot flag, can be either 1 or 0
IsGame1Decimal hotspot flag, can be either 1 or 0
IsSetToFW1Decimal hotspot flag, can be either 1 or 0
IsZone1Decimal hotspot flag, can be either 1 or 0. This field was added for newer NZone hotspot.conf versions.

Hotspots #

Hotspots not listed in hotspot.conf can only be used via NZone beacons. The below flags is the combined “IsXXX” fields from hotspot.conf, excluding IsSetToFW. The below hotspot.conf version specifies what title version that hotspot was added to the list, if at all.(“Unknown” indicates that the hotspot is present in v1024, but it’s unknown whether it was in the previous version.)

Hotspot list from NZone hotspot.conf #

SSIDSecurityRegion/countryServiceNameFlagsHotspot.conf version
wifineNoneJPNπŸ”— Wifine1, 1, 1, 1, 1Unknown
NintendoSpotPass1NoneEURNintendo1, 1, 1, 1, 1Unknown
NintendoSpotPass2NoneEURNintendo1, 0, 0, 0, 1Unknown
attwifiNoneUSAAT&T1, 1, 1, 1, 1Unknown
SIMON WiFiNoneUSASimon Malls1, 1, 1, 1, 1Unknown
noasp01NoneUSANOA (Nintendo events)1, 1, 1, 1, 1Unknown
noasp02NoneUSANOA (Nintendo events)1, 1, 1, 1, 1Unknown
TelekomNoneEUR (Germany)Telekom1, 0, 0, 0, 1Unknown
Telekom_ICENoneEUR (Germany)Telekom1, 0, 0, 0, 1Unknown
GuglielmoNoneITGuglielmo1, 1, 1, 1, 1Unknown
ASTRONoneITGuglielmo1, 1, 1, 1, 1Unknown
Banca Sella WiFi ClientiNoneITGuglielmo1, 1, 1, 1, 1Unknown
confindustriaNoneITGuglielmo1, 1, 1, 1, 1Unknown
GrandNoneITGuglielmo1, 1, 1, 1, 1Unknown
Guglielmo Rimini WiFiNoneITGuglielmo1, 1, 1, 1, 1Unknown
GuglielmoDallaRosaPratiNoneITGuglielmo1, 1, 1, 1, 1Unknown
HotelsNoneITGuglielmo1, 1, 1, 1, 1Unknown
L.BettoloNoneITGuglielmo1, 1, 1, 1, 1Unknown
LecceWirelessNoneITGuglielmo1, 1, 1, 1, 1Unknown
P.zza NicolosoNoneITGuglielmo1, 1, 1, 1, 1Unknown
PortoDiTriesteNoneITGuglielmo1, 1, 1, 1, 1Unknown
Comune-Na Piazze WIFINoneITGuglielmo1, 1, 1, 1, 1Unknown
WiFi_StampaNoneITGuglielmo1, 1, 1, 1, 1Unknown
KPNNoneEUR (NL)KPN1, 1, 0, 1, 1Unknown
METEORNoneFRMeteor1, 0, 0, 0, 1Unknown
MCDONALDSNoneFRMeteor1, 0, 0, 0, 1Unknown
AREA_by_METEORNoneFRMeteor1, 0, 0, 0, 1Unknown
PATaPAIN_by_METEORNoneFRMeteor1, 0, 0, 0, 1Unknown
CASINO_by_METEORNoneFRMeteor1, 0, 0, 0, 1Unknown
all_seasons_by_METEORNoneFRMeteor1, 0, 0, 0, 1Unknown
ADAGIO_by_METEORNoneFRMeteor1, 0, 0, 0, 1Unknown
PULLMAN_by_METEORNoneFRMeteor1, 0, 0, 0, 1Unknown
Best_Western_by_METEORNoneFRMeteor1, 0, 0, 0, 1Unknown
CreditAgricole_by_METEORNoneFRMeteor1, 0, 0, 0, 1Unknown
IBIS_by_METEORNoneFRMeteor1, 0, 0, 0, 1Unknown
MERCURE_by_METEORNoneFRMeteor1, 0, 0, 0, 1Unknown
TelefonicaNoneESTelefonica1, 0, 0, 1, 1Unknown
GOWEXWiFiNoneESGowex1, 0, 0, 1, 1Unknown
OurenseWiFiNoneESGowex1, 0, 0, 1, 1Unknown
RED_LIBRE_AVILES_WILOCNoneESGowex1, 0, 0, 1, 1Unknown
GIJON WIFINoneESGowex1, 0, 0, 1, 1Unknown
01MIERESWIFINoneESGowex1, 0, 0, 1, 1Unknown
01EibarWifiNoneESGowex1, 0, 0, 1, 1Unknown
WIFIBURNoneESGowex1, 0, 0, 1, 1Unknown
ValladolidWiFiNoneESGowex1, 0, 0, 1, 1Unknown
01PuertoDelRosarioWiFiNoneESGowex1, 0, 0, 1, 1Unknown
PT-WIFINonePTPTWiFi1, 0, 0, 0, 1Unknown
FON_ZON_FREE_INTERNETNonePTZON1, 0, 0, 0, 1Unknown
πŸ”— WiFi Zone - The CloudNoneEUR (GB)πŸ”— The Cloud1, 1, 1, 1, 1Unknown
πŸ”— MycloudNoneEUR (GB)πŸ”— The Cloud1, 1, 1, 1, 1Unknown
πŸ”— WLAN Zone - The CloudNoneEUR (GB)πŸ”— The Cloud1, 0, 0, 0, 1Unknown
πŸ”— _The CloudNoneEUR (GB)πŸ”— The Cloud?After v1024
FREESPOTNoneJPNFREESPOT1, 1, 1, 1, 1Unknown
πŸ”— TSUTAYANoneJPNTSUTAYA?Unknown
Wayport_AccessNoneUSAMcDonalds?After v1024
Boingo HotspotNoneUSABoingo?Unknown
ibahnNoneUSAiBAHN?Unknown
BELLWIFI@MCDONALDSNoneUSA (Canada)Bell?After v1024
πŸ”— free-hotspot.comNoneEURfree-hotspot.com?After v1024
BestbuyWPA2-PSKUSABestbuyAfter v1024

See also πŸ”— this.

NZone hotspots only accessible via NZone beacons #

SSIDSecurityRegion/countryServiceNameNotes
noasp03NoneUSANOA (Nintendo event at GDC)
BestBuyNoneUSABestBuy
πŸ”— 7SPOTNoneJPN7-11A LAN-only hostname used is for the retailer’s site linked to from the NZone server.

The above hotspots can only be accessed by broadcasting NZone beacons which contain the encrypted Nintendo tag data.

Hotspot Notes #

  • These can be configured on you own router/laptop/phone to identify as a Nintendo Zone.
  • You will need an available Internet connection to be able to connect to the servers.
  • After connecting the Wi-Fi network, the page displayed will be of the device’s region. (Some regions, such as Australia, will not be redirected to a local Nintendo Zone page as there are no plans to introduce Nintendo Zone(s) to that region. If a 3DS has its region set to one of these regions where there are no plans to introduce a Nintendo Zone, they will be brought to the Nintendo Zone of the region of the SSID)
  • If you intend to create a permanent, private, Nintendo Zone WiFi spot. It is recommended that you enable MAC address filtering to only allow your devices. As using any form of encryption will prevent the Nintendo Zone WiFi spot from working with your 3DS.