This repo contains configurations, scripts, and certificates for using
mitmproxy
/mitmweb
/mitmdump
to intercept traffic from Nintendo consoles,
including the Wii U and the 3DS. It supports multiple operation modes, including
redirecting requests to a local Pretendo Network server and collecting Wii U and
3DS network dumps.
This fork is configured for use with my selfhosted Pretendo Network setup.
- Download and install Docker using the official guide.
- First, make sure to disable Inkay or Nimbus to ensure that you are
connected to the official Nintendo Network servers. Then, download the right
NoSSL patches for your console.
- Wii U: Download this patch and copy it to
your SD card as
sd:/wiiu/environments/aroma/modules/setup/30_nossl.rpx
. (Replacearoma
withtiramisu
if you use Tiramisu.) - 3DS: Download this patch and copy it
to your microSD card as
sd:/luma/sysmodules/0004013000002F02.ips
.
- Wii U: Download this patch and copy it to
your SD card as
- Configure your console to connect to the proxy server.
- Wii U:
- Open System Settings => Internet => Connect to the Internet => Connections => (Your current internet connection) => Change Settings.
- Go to Proxy Settings => Set => OK => (Set the proxy server to your computer's IP address and the port to 8082) => Confirm => Don't Use Authentication.
- 3DS:
- Open System Settings => Internet Settings => Connection Settings => (Your current connection) => Change Settings.
- Go to Proxy Settings => Yes => Detailed Setup => (Set the proxy server to your computer's IP address and the port to 8083) => OK => Don't Use Authentication.
- Wii U:
- Copy the command that matches your console and paste it inside a terminal
window to start the proxy server inside a Docker container.
- Wii U:
docker run -it --rm -p 8082:8082 -v ./dumps:/home/mitmproxy/dumps ghcr.io/pretendonetwork/mitmproxy-nintendo:wiiu mitmdump
- 3DS:
docker run -it --rm -p 8083:8083 -v ./dumps:/home/mitmproxy/dumps ghcr.io/pretendonetwork/mitmproxy-nintendo:3ds mitmdump
- Wii U:
- Check your terminal window to make sure that your console is connecting to the proxy server. You should see some "client connect" and "client disonnect" messages.
- Do whatever activity you want to have in the network dump.
- Press
Control
andC
in the terminal window to stop the proxy. This will create a network dump HAR file in thedumps
folder, which you can find in the current folder that your terminal is running in (if you don't know, run thepwd
command). - Rename the HAR file (
wiiu-latest.har
or3ds-latest.har
) in thedumps
folder to something descriptive.- Warning: If you don't rename the dump before restarting the proxy container, it will be overwritten!
- Go back to step 4 for your next network dump.
- Upload your HAR files to any public channel in the Pretendo Network Discord
server to share them with the developers.
- Note: Make sure to upload the HAR files directly so they can be automatically deleted and reuploaded in a private channel for the developers. Don't zip the folder.
When you are finished with collecting network dumps, go back into your console's Internet settings and disable the proxy server. For security reasons, please also delete the NoSSL patch you downloaded in step 2.
- Choose a method below to run mitmproxy (Docker or local install).
- Set up your console to connect the the proxy (see below).
This is the recommended way to run mitmproxy-nintendo because it always uses the latest image and is already set up with OpenSSL 1.1.1.
- Install Docker using the official instructions.
- Run a new Docker container using the
ghcr.io/pretendonetwork/mitmproxy-nintendo
image.- If you're not familiar with Docker, copy the
docker run ...
command from this script to get started. Then, open https://127.0.0.1:8081/ in your browser to access themitmweb
web interface for mitmproxy. - Note that if you delete the
mitmproxy-pretendo-data
volume, the mitmproxy server certificates will be regenerated and you will need to set up the SSL patches with your custom certificates again.
- If you're not familiar with Docker, copy the
If you want to make modifications to the image, you need to rebuild it locally.
- Clone this repository to your computer
(
git clone https://github.com/PretendoNetwork/mitmproxy-nintendo.git
). - Use the
./start-docker.sh
script to build and run the container. This build overwrites the version you downloaded from the container registry. This will take a few minutes the first time, but it will be cached for future builds.- You need to rebuild the container every time you change something here.
If you want to revert your local image to the published version, run
docker pull ghcr.io/pretendonetwork/mitmproxy-nintendo
.
This method can be used if you don't want to install Docker or just generally prefer not to use Docker.
Note you may run into some issues depending your OpenSSL version. Many current Linux distributions now use OpenSSL 3.0.0 instead of 1.1.1. OpenSSL 3.0.0 disables protocols TLSv1.1 and earlier by default, but the console does not support TLSv1.2 or later. Because of this, HTTPS connections to the proxy will fail if mitmproxy is using OpenSSL 3.0.0.
- Install Python 3 and pip.
- Clone this repository to your computer
(
git clone https://github.com/PretendoNetwork/mitmproxy-nintendo.git
). - Create a virtual environment with
python3 -m venv venv
. - Activate the virtual environment with
. ./venv/bin/activate
. - Install mitmproxy with
pip install mitmproxy
.- Test that mitmproxy is working by running
mitmproxy --version
. - If the OpenSSL version is above 3.0.0, the console will fail to connect via HTTPS. Consider using the Docker container instead, or compile a custom version of OpenSSL and Python cryptography (see below).
- Test that mitmproxy is working by running
- Run one of the launcher scripts (i.e.
./mitmproxy
) to launch the mitmproxy server.
Running the launcher script will automatically load the Pretendo addon script.
This will add the custom pretendo_*
options to mitmproxy that allow you to
redirect HTTP requests to your local server.
- Install Pretendo Network patches on your console using the official guide:
- Configure your console to connect to the proxy using its system settings. Set the console's proxy server to your computer's IP address and the port to 8080.
The Pretendo patches normally use a Let's Encrypt certificate for HTTPS connections, but you can modify them to use your mitmproxy certificate instead. Fortunately, it's pretty easy if you use Docker to compile the patches.
- Clone the Inkay patcher
(
git clone https://github.com/PretendoNetwork/Inkay.git
) - Copy your mitmproxy certificate.
- If you're using the Docker container, run
docker run -it --rm -v mitmproxy-pretendo-data:/mnt busybox cat /mnt/mitmproxy-ca-cert.pem
. - If you're running mitmproxy locally, run
cat .mitmproxy/mitmproxy-ca-cert.pem
.
- If you're using the Docker container, run
- Replace the contents of
./Inkay/data/ca.pem
with your mitmproxy certificate. - Run
docker build Inkay -t inkay-build
to build the Inkay build environment. - Run
docker run -it --rm -v $(pwd)/Inkay:/app -w /app inkay-build
to compile the patches. - The compiled patch will be in
./Inkay/Inkay-pretendo.wps
. Copy this patch to your SD card over FTPiiU by runningftp -u ftp:https://a:a@WIIU_IP/fs/vol/external01/wiiu/environments/aroma/plugins/Inkay-pretendo.wps ./Inkay/Inkay-pretendo.wps
, replacing theWIIU_IP
with your Wii U's IP address. This will replace the Pretendo patch with your version with custom certificates. - Reboot your Wii U.
Due to Inkay's dependencies, it would be quite difficult to compile the patches
without using Docker. If you don't want to install Docker, you could try forking
the Inkay repository on GitHub, editing the data/ca.pem
file in your fork, and
building it with GitHub Actions.
If you want to revert back to the regular Pretendo Network patches, re-download them from the Inkay repository and upload them back to your Wii U.
Copy the mitmproxy-ca-cert.pem
file to your microSD card as
sd:/3ds/juxt-prod.pem
.
See the Dockerfile for the necessary build steps. If you are
doing this on your primary system, be very careful to not mess with your system
package manager's OpenSSL installation, as this would break everything that
relies on OpenSSL. Make sure you use a custom prefix like /opt/openssl
when
compiling OpenSSL 1.1.1. Use the steps to install a custom build of Python
cryptography in your mitmproxy virtual environment.
If you want to intercept your console's HTTPS traffic with mitmproxy all the time without using the Pretendo patches, you will need to replace your console's server certificate with the mitmproxy certificate. Note that this is somewhat dangerous, as a corrupted certificate can brick your Home Menu. This should be safe using a coldboot CFW like CHBC, Tiramisu, or Aroma, but be aware of the risk.
- Back up all of your Wii U's certificates from
/storage_mlc/sys/title/0005001b/10054000/content
. This backup will be necessary to undo any modifications. - Convert your mitmproxy certificate to the right format by running the command
openssl x509 -in ./configuration/mitmproxy-ca-cert.pem -outform der -out CACERT_NINTENDO_CA_G3.der
. - Upload the created
CACERT_NINTENDO_CA_G3.der
file to/storage_mlc/sys/title/0005001b/10054000/content/scerts
, replacing the original file.
To undo this modification, upload the backup files back to the content
folder.