Dreamcast: Daytona USA Online.

 

Last night I attempted to find out more info about Daytona USA.
Because last week I also tried going online but it required the Daytona Key
so it fail at first screen….

so lets explore

Maybe some else can use this information to recreate a Daytona Server.

So the first thing to do is look for the key!

found this info:

Well, I had to do some VMU file re-arranging today, and that included
deleting my Daytona Battle Key. Well, after re-downloading a new key, I
noticed that my old character name, GoodCow, was “already registered.” =(
So, I guess I just learnt that the server attaches user names, directly to
the key file ID number, which by the way, is generated on the fly by the
server. I had thought that it tied user names to the “Sega.com user name”
which was just in the battle key. But, I guess it doesn’t work that way.
Maybe the wins and losses are stored in the battle key file as well? So, a
word of “warning” is that if you ever delete your Daytona battle key, your
user names are gone. When you download a new key, since it’ll have a new
“key ID” (currently at 20,465), it won’t have your old user name data in it.
http://daytona.web.dreamcast.com/key/vm_data/data/

Only 20,465 people have downloaded keys. That’s pretty sad. Also, the server
deletes old keys I believe every Saturday.:

http://daytona.web.dreamcast.com/key/vm … a/crontest
# cron daytona [1 record]
# server name : daytona.web.dreamcast.com
# for remove VMS and VMI files
# Sunday – Saturday, 00:37, EXECUTION FILE:removevm.sh
37 00 * * * /home/daytona/site/htdocs/key/vm_data/data/removevm.sh >>
/home/daytona/site/htdocs/key/vm_data/data/cron_removevm.log

Anything important in this post? Not really. But if anybody makes some
extremely comprehensive Dreamcast and/or Dreamcast online FAQ, this would
make for a nice tid-bit in the Daytona section.

*GoodCow who has saved his new generated on-the-fly battle key to his HD as
well for the future, in case I ever need to delete the key again*

And later this week i also found the Daytona USA key online

Daytona Key file download

And I think its GoodCows version because it also got the cron log and the SH for deleting the keys.
Also this info gives use some info on how the server is build. There is a username used for the server “daytona’
We can read this in the log. Because that is also the user that deleted the vms data in the cron job.

Some things to know I use this version of Daytona:
[Game_ID]
XGame_ID=’MK-51037′
XGame_Ver=’V1.004′

Uploaded the Key to my  VMU.
So if I boot now in to battle Net i get a bit closer to the server login:

I tried to sniff some information using wireshark but din’t find anything usefull
Think I need to change the Server (46.101.91.123) in DreamPi to my IP where I am running WireShare.
Will this later. For some strange reason my DreamPi is working perfect now no lockups anymore…
But next reboot the DNS will be changed and I can inspect maybe the packets that are send.
This is for next post.

Its a shame that DreamPi is not showing any good information for me when it tries to connect to the server:

I gathered a lot of information in the last 2 days and I needed to write it down first.

That is the reason for this post.
There are 2 interesting bin files on the CD  2_DP.BIN and DAYNET.BIN

Opening up DAYNET.BIN will give a ton of information on the client side:
2_DP.BIN is the Homepage needed to create the KEY file more info bellow.
First DAYNET because it gives use the client information and bit Server info.

interesting names used:

SRVRCLNT
I Think thing below are found in the KEY file or are files needed on VMU
DAYTONA USA REPLAY
DAYTONA USA GHOST
DAYTONA__R
DAYTONA__G
DAYTONA__CNF
DAYTONA USA
DAYTONA__KEY

Nice string: commodity_id=&user_id=&login_password=POST /cgi-bin/auth.cgi

DAYTONA__R
DAYTONA__G
DAYTONA__K
DAYTONA__CNF

NUMBER OF NODE(S) %d OF %d OF %dID %08X

SUPPORT %08X
ON %08X
OFF %08X
PRESS %08X
RELEASE %08X
R %08X
L %08X
X1 %08X
Y1 %08X
X2 %08X
Y2 %08X
NAME %s
EXTEND %s
RESERVE %s
INFO * %08X
TYPE %08X
RESERVE %08X
IS ROOT %08X
AREA CODE %08X
DIRECTION %02X %02X
PRODUCT %s
LICENSE %04X
STAND BY %d mA
MAX POW %d mA
SOUND WARNING: %d %d

NETENGINE Ver 1.69 for NetSDK

COPYRIGHT (C) SEGA ENTERPRISES,LTD.NAOMI LIBRARY Ver 0.8 AM R&DNAOMI LIBRARY Ver 0.8 AM R&D

Build:Nov 06 2000 11:35:09Nov 06 2000 11:35:09NLOBJPUT Ver 0.99
COPYRIGHT (C) SEGA ENTERPRISES,LTD.Aug 24 2000 13:56:19
NLOBJPUT Ver 0.99 SOFT R&D1 Build:Aug 24 2000 13:56:19
NLSPRITE Ver 0.2 COPYRIGHT (C) SEGA ENTERPRISES,LTD.Feb 21 2000 21:10:33d§
libspr Ver 0.2 Build:Feb 21 2000 21:10:33
[LobbyEngine] Deleting task at access server disconnection: %d
[LobbyEngine] Deleting task at lobby server disconnection: %d
[LobbyEngine] detected lobby server disconnection
[LobbyEngine] connecting to access server: %s, phone:%s
[LobbyEngine] initialize PPP FAILED
[LobbyEngine] start dialing…
[LobbyEngine] modem ready check TIMED OUT
[LobbyEngine] connected, establishing PPP connection…
[LobbyEngine] PPP connection established000000000000
[LobbyEngine] skipping SEGA auth
[LobbyEngine] entering SEGA authentication stage…
[LobbyEngine] password or username was NOT specified
[LobbyEngine] function UA_Initialize returns an ERROR: %d
[LobbyEngine] SEGA auth query with commodity:%s user:%s pass:%s
[LobbyEngine] SEGA authentication FAILED param.error_no: %d
[LobbyEngine] SEGA authentication SUCCEED
[LobbyEngine] SEGA auth stage has been finished successfly
[LobbyEngine] contacting to GateServer %s:%d(tcp) > my guess auth01.dricas.com
[LobbyEngine] create connection for GateServer FAILED
[LobbyEngine] connecting gate server succeed, sending server list request
[LobbyEngine] connecting gate server FAILED
[LobbyEngine] all lobby server list has been received
[LobbyEngine] receiving server list TIMED OUT
[LobbyEngine] connect to access server has been successfully completed.
[LobbyEngine] contacting to LobbyServer %s:%d(tcp) > my guess 208.213.61.207:37126 on 9500
[LobbyEngine] create connection for LobbyServer FAILED
[LobbyEngine] sending login information for LobbyServer
[LobbyEngine] nickname has been changed: %s
[LobbyEngine] LobbyServer logged in
[LobbyEngine] LobbyServer login FAILED
[LobbyEngine] LobbyServer exmem ready
[LobbyEngine] LobbyServer EX MEM FAILED%s %sREQUEST_FILTER dummy SEGA-ID TOURNAMENT ARCADE GROUP RRT
[LobbyEngine] disconnecting from LobbyServer
[LobbyEngine] LobbyServer added, [%d]%s address: %s:%d0123456789ABCDEF:%s :%s :%s :%s :%d :%d%s %d %d %s SPECTATORNORMAL:#%s %s%s %s%s %s %s%d%s %d %d#%sioctrl netsdk ver 0.30

in_len >= 0miniutil.cin_c >= 0in_s2len >= 0in_slen >= 0in_keylen >= 0

RSA information:

< †Ç∫A⁄˜ô§0ÉåÉOC=”US”, O=”RSA Data Security, Inc.”, OU=”Secure Server Certification Authority”0Ç40Ç
°≠f~NE˛^Wo<ò^›¿0  *ÜHܘ

0_10 UUS1 0U
RSA Data Security, Inc.1.0,U%Secure Server Certification Authority0 941109000000Z 100107235959Z0_10 UUS1 0U
RSA Data Security, Inc.1.0,U%Secure Server Certification Authority0Åõ0

PACKET and SOCKET:

$CMS#ACS%CPR02012 IN SOCKET BYTE ODER IS 386BSD(8086) TYPE∞∞å¥∞å∏∞åº∞å¿∞åƒ∞å»∞åÃ∞å–∞å‘∞åÿ∞å‹∞åABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/



3
Packet Driver
Äíï 
Äíï xV44
»“+廓+åˇˇÏ±åÙ±帱å≤å≤å≤å≤å$≤å,≤å0≤å4≤å8≤å<≤å$CMS#ACS%CPR02010 SOCKET LIB Version 1.03 (1993.11.19)$
t≤å *ÜHÜ

MODEM INFORMATION

Sega BuiltIn modem REV 1.0309a097840F284C6403FbF60430000r1031111111010000r3000111010000000BELMNQVWXY&B&C&D&E&G&I&J&K&L&N&O&P&Q&R&S&U&X&Y%C%D\A\C\F\G\J\K\N\V@CPHONE NUMBERS :&Z= Modulation type: Bell 103Bell 1200V21 300V23 75TX/1200RXV23 1200TX/75RXV22 1200V22 600V22bis 1200V22bis 2400V32 4800V32 9600 (treillis coded)V32 9600 (uncoded)V32bis 4800V32bis 7200V32bis 9600V32bis 12000V32bis 14400V32terbo 16800V32terbo 19200V34 K56 V90 message not listed%dReceive level: -DSP`s Receive mean square error: 0xRound trip delay: msNear echo level: – dbmFar echo level: -Termination reason………. LOCAL REQUESTLINK DISCONNECTLast Tx data rate……….. Highest Tx data rate…….. Last Rx data rate……….. Highest Rx data rate…….. Error correction protocol… LAPMMNPNONEData compression………… V42BisLine quality……………. Enter new key :Retype for verification :(,)29BLACKLISTED
send”AT&F\r”
wait”OK\r\n”,5
\r”
wait”OK\r\n”,5
send”AT&F\r”
wait”OK\r\n”,5
dial”%t”
send “ATW3E0V1%C0\N0send”ATX4\r”
wait”OK”,5
send”ATX3\r”
wait”OK”,5
send”ATM0\r”
wait”OK”,5
send”ATM1\r”
wait”OK”,5
T≠å

OK CONNECT RING NO CARRIER ERROR CONNECT 1200 NO DIALTONE BUSY NO ANSWER CONNECT 600 CONNECT 2400 CONNECT 4800 CONNECT 9600 CONNECT 14400 CONNECT 19200 CONNECT 38400 CONNECT 57600 CONNECT 115200 RINGING CONNECT 230400 CONNECT 48000 CONNECT 64000 CONNECT 300 CARRIER 50000CONNECT 460800CONNECT 691200CONNECT 921600CONNECT 56000 CARRIER 52000 CARRIER 54000CARRIER 38400CARRIER 48000CARRIER 56000CARRIER 57600CARRIER 64000CARRIER 32000CARRIER 34000CARRIER 36000CARRIER 38000CARRIER 40000CARRIER 300CARRIER 600CARRIER 3600CARRIER 42000CARRIER 44000CARRIER 46000CARRIER 1200CARRIER 2400CARRIER 4800CARRIER 7200CARRIER 9600CARRIER 12000CARRIER 14400CARRIER 16800CARRIER 19200CARRIER 21600CARRIER 24000CARRIER 26400CARRIER 28800CONNECT 16800CONNECT 7200CONNECT 12000CONNECT 75TX/1200RXCONNECT 1200TX/75RXCARRIER 75TX/1200RXCARRIER 1200TX/75RXCONNECT 21600CONNECT 24000CONNECT 26400CONNECT 28800PROTOCOL: NONECONNECT 32000CONNECT 34000CONNECT 31200CONNECT 33600CONNECT 36000CONNECT 38000PROTOCOL: V42CONNECT 40000PROTOCOL: MNP RELCONNECT 42000CONNECT 44000PROTOCOL: X.25PROTOCOL: V.120PROTOCOL: V.110CARRIER 31200CARRIER 33600PROTOCOL: PPPPROTOCOL: MLPPPCONNECT 46000AUTOLOGON FAILED PROTOCOL: V.120 COMPRESSIONPROTOCOL: X.75CONNECT 50000CONNECT 52000CONNECT 54000CONNECT 128000TEST FAILEDTEST PASSEDCIRCUIT BUSYPROTOCOL: HDLCCARRIER 112000CARRIER 128000PROTOCOL: PIAFSCONNECT 28000CONNECT 29333CONNECT 30666CONNECT 33333CONNECT 34666CONNECT 37333CONNECT 38666CONNECT 41333CONNECT 42666CONNECT 45333CONNECT 46666CONNECT 49333CONNECT 50666CONNECT 53333CONNECT 54666CARRIER 28000CARRIER 29333CARRIER 30666CARRIER 33333CARRIER 34666CARRIER 37333CARRIER 38666CARRIER 41333CARRIER 42666CARRIER 45333CARRIER 46666CARRIER 49333CARRIER 50666CARRIER 53333CARRIER 54666%d BPS

Response and request:

Wellcome!!Request timeoutRequest retry exceeded

Chap
CONFIG_REQ
CONFIG_ACK
CONFIG_NAK
CONFIG_REJ

TERM_REQ
TERM_ACK

CODE_REJ
PROT_REJ
ECHO_REQ
ECHO_REPLY
DISCARD_REQ
QUALITY_REPORT ???
CLOSED
LISTEN
REQ_Sent
ACK_Rcvd
ACK_Sent
OPENED
TERM_Sent
DEBUG:
ppp/lcp:
recv %s on %s

Welcome Invalid username or password Request timeout Request retry exceeded Pap

leave: fail1(err = %d)
leave: fail2(err = %d)
leave: fail3(stat.stat = %d)
leave: fail2(stat.stat = %d)
leave: none
enter: FStream_Read(self = %d, in_buff = xxx, in_len = %d)
leave: fail1(result = RECV-FIN
leave: ok(result = %d
%s %s %d %02d:%02d:%02d %d
JanFebMarAprMayJunJulAugSepOctNovDecSunMonTueWedThuFriSatDEBUG: %s(%d)
minitcp.c

Build log information:

gdFs Ver 1.12 Build:Sep 06 2000 13:59:24
pdKbd Ver 1.51 Build:Jul 30 1999 15:01:35
pd Ver 1.50 Build:Jul 30 1999 15:01:33
syMalloc Ver 2.01 Build:Aug 09 2000 17:33:28
syRtc Ver 1.02 Build:May 31 1999 09:05:20
syHw Ver 1.08 Build:Jul 06 2000 09:42:59
bu Ver 1.51 Build:Aug 24 2000 10:23:46
VMS File System for Application(dynamic work alloc)
syBtFnt Ver 1.02 Build:May 31 1999 09:01:19
syCfg Ver 1.15 Build:Apr 26 1999 14:38:59
syBtCfg Ver 1.03 Build:Apr 26 1999 14:36:52
pdVib Ver 2.01 Build:Feb 15 2000 12:20:25
syBt Ver 1.07 Build:Jun 22 2000 16:16:08
SEGA_FH01_OK
SEGA_FH01_EXIST
SEGA_FH01_PROCESS1
SEGA_FH01_PROCESS2
uf Ver 2.02 Build:Feb 07 2000 19:21:21
syExtChk Ver 2.03 Build:Oct 05 2000 13:25:06
KATANA_FLASH____fmMng Ver 1.04 Build:Apr 26 1999 14:34:41
SEGA Ninja Library
Ninja Ver 01100114 Build:Jul 03 2000 18:12:08
MMU OFF %sE8101202: can’t open %d, %d (ADXT_StartAfs)
E8101205: can’t open ‘%s’ (ADXT_StartFname)
E8101207: can’t create sj (ADXT_StartMem)
E8101207: can’t create sj (ADXT_StartMemIdx)
ADXT Ver.5.78 Build:Mar 07 2000 19:35:16
E8101208: parameter error (ADXT_SetOutPan)® åRENDERVSYNCCountRegionSizeObjListSizeISPParamSizeTSPParamSizeVertexBufferBufferBaseBufferSizePoolingTAStatusRenderTimeOutVertexTimeOutVSYNCTimeOut
KAMUI Ver 1.11.0.0 Build:Jul 26 1999 19:23:10
KAMUIVideoModeDisplayModeAntiAliasDither

Proccess errors:

SEGA_FH01_PROCESS2Ä?Ä?Ä?Ä?*õ∂≠
1E8101210: can’t open ‘%s’ (ADXSTM_OpenFname)
E8101211: can’t GetFileSize (ADXSTM_OpenFname)
E8101212: can’t open fad=%d, nsct=%d (ADXSTM_OpenRange)OpenRange
E8101213: can’t open ‘%s'(ADXSTM_OpenFnameRange)
E8101201: not enough data (adxt_trap_entry)
E9081001: can’t play %d ch data (maxch=%d) [adxt_stat_decinfo
9040801:’ptid’ is range outside.(adxf_ChkPrmPt)
E9040802:’ptinfo’ is NULL.(adxf_ChkPrmPt)
E9040803:can’t get FAD of ‘%s’.(ADXF_LoadPartition)
E9040804:can’t open ‘%s’.(ADXF_LoadPartition)
E9040805:read error’%s’.(ADXF_LoadPartition)
E9040806:’%s’ is broken.(ADXF_LoadPartition)
E9040807:can’t find ‘%s’.(ADXF_AddPartition)
E9040808:cannot open ‘%s’.(ADXF_AddPartition)
E9040809:read error’%s’.(ADXF_LoadPartition)
E9040810:’%s’ is broken.(ADXF_LoadPartition)
E9040901:can’t find ‘%s’.(ADXF_Open)
E9040902:can’t get file size(sct) ‘%s’.(ADXF_Open)
E9040903:can’t get file size(byte) ‘%s’.(ADXF_Open)
E9040811:’adxf’ is NULL.(adxf_read_sj32)
E9040812:’nsct’is negative.(adxf_read_sj32)
E9040813:’sj’is NULL.(adxf_read_sj32)
E9040815:’adxf->stm’ isn’t NULL.(adxf_read_sj32)
E9040816:’adxf’ is NULL.(ADXF_ReadNw32)
E9040817:’nsct’ is negative.(ADXF_ReadNw32)
E9040818:’buf’ is NULL.(ADXF_ReadNw32)
E9040819:alignment of ‘buf’ isn’t 32byte.(ADXF_ReadNw32)
E9040821:’sj’ is NULL.(ADXF_ReadNw32)
E9040822:’adxf’ is NULL.(ADXF_Stop)
E9040823:’adxf->stm’ is NULL.(ADXF_Stop)
E9040825:’adxf’ is NULL.(ADXF_Seek)
E9040826:’type’ is illigal.(ADXF_Seek)
E9040827:’adxf’ is NULL.(ADXF_Tell)
E9040828:’adxf’ is NULL.(ADXF_GetFsizeSct)
E9040829:’adxf’ is NULL.(ADXF_GetFsizeByte)
E9040830:’adxf’ is NULL.(ADXF_GetNumReqSct)
E9040831:’adxf’ is NULL.(ADXF_GetNumReadSct)
E9040832:’adxf’ is NULL.(ADXF_GetStat)
E9040828:’ptid’ is range outside.(ADXF_GetFileRange)
E9040828:’flid’ is range outside.(ADXF_GetFileRange)
ADXF Ver.5.55 Build:Sep 08 1999 21:25:47
E1201:mwRnaCreate Illigal parameter (MAXNCH)
E1202:mwRnaCreate Illigal parameter (SJ)
E1203:mwRnaCreate Not enough instance (MWRNA)
E1204:mwRnaCreate Cannot open MWSND
E1205:Illigal parameter (MWRNA=NULL)
E1213:mwlRnaAddWrPos rna->sj=NULL
E1212:mwlRnaStartTrans rna->sj=NULL
E1211:mwRnaSetNumChan Illigal parameter(NCH>MAXNCH)
E1207:mwRnaSetFx Illigal parameter (FXCH)
mwRna Ver.1.33 Build:Mar 06 2000 21:22:35
DEST SJ Ver.5.53 Build:Feb 25 2000 10:11:30
E0001: Illigal parameter=sj (LSC_Create)
E0002: Not enough instance (LSC_Create)
E0003: Illigal parameter lsc=NULLE
0011: Illigal parameter fname=%s
E0009: Illigal parameter no=%d
E0012: Can not find stream ID =%d
E0010: Illigal parameter min=%dHARDWAREEnableTexture16MBHARDWAREEnableTexture16MB

There is more info in the 2dp.bin mostly java and html code.

Unfiltered information because it think this is the homepage (last option in Daytona Menu)
And this will not help us getting online in Net Battle:

.avefront/navigation/loadcurhistoryabout:visit
x-avefront://—.dream/util/visitmailto:
x-avefront://—.dream/proc/play/mpeg/play/adx/menu/eu-register/reseteu-register/reconnect
x-avefront://—.dream/vms/selectapplication/
x-dreamcast-vms-infoapplication/
x-apple-autoconfigure-dialerSIZE
x-avefront://—.dream/vmsfile/SEGA/Profilehttp://profile.dricas.com/profile/index.htmlhttps://profile.dricas.com/profile2/index.html0120-535850profileeliforphttp://charge.dricas.com/charge/index.htmlhttp://email.dream-key.com/http://chat.dream-key.com/about:visitDownloading…<br><br>

NDDMThdMTrkautoclosenoguipalntsc*
dialog.mpeg.player*
dialog.startpage*cast.startpage.dricas*cast.startpage.gameinfo*cast.startpage.mail*cast.startpage.userinfo*cast.startpage.account*cast.startpage.book*cast.startpage.pref*cast.startpage.chat*cast.startpage.tv.shadow*cast.startpage.tvbghttp://www.dricas.com/http://www.dricas.ne.jp/http://www.d-direct.ne.jp/
file:/dpwww/home_day.gif
file:/dpwww/home_night.jpg
application/x-dreampassport-startpagedsp*cast.startpage.tv*cast.startpage.tv.1/1*cast.startpage.tv.2/3*cast.startpage.tv.3/3*cast.startpage.tv.5/5*cast.startpage.tv.7/7*cast.startpage.tv.12/25
Title: %s<br>Creator: %s<br>Version: %d.%02d<br># of Files: %d (%d blocks)<br><br>Do you want to download this file?

-GAME- -DATA-cannot copy           change info L or R trigger* other user’s file                   * not Dream Passport file<br><br><br><br> change info L or R triggerˇ˛?
˛˛ICONDATA_VMS/dptutor/sd_err != SDE_ERR_NO_INITdream\tutorial\prtutor.c/v->ADX_Addrdream\tutorial\prt_sub.cv->TutorDirBuffv->VoiceDirBuff/dptutorerr == GDD_ERR_OK/dptutor/voice/dptutor/pvr/title/st_bg.pvrstart.pvrwaku.pvrÉåÉbÉcì¸ñÂÅIÉhÉäÉpÉXÇQÇèIóπǵNjÇ∑Ç©ÅH/dptutor/Ä?fff?öôY?33S?P?P?öôi?ffv?ÕÃ|?Ä?ÄøÄÄÄÄÄÄÄÄÄÄÄÄ/dptutor/model/pet_expet_inu.njî?å§?å¥?å»?ånorm_inu.njmsippo_inu.njmhanabura_inu.njmhanatare_inu.njmpMemoryTexdream\tutorial\prt_text.cpTexInfopTexNamepTexListerr == 1pTexAnimpSpritev->ptr[0]dream\tutorial\prt_chpt.cv->ptr[1] Gå,Gå<GåLGå\GåhGåtGåtGå/dptutor/pvr/main/main.pvrmain02.pvrmw01.pvrmw02.pvrmw31.pvrmw04.pvrmw05.pvrmw06.pvrmw07.pvrmw08.pvrmw09.pvrmw09_b.pvrmw10.pvrmw11.pvrmw32.pvrmw32_b.pvrmwindow.pvrmw12.pvrmw13.pvrmw14.pvrmw15.pvrmw16.pvrmw17.pvrmw18.pvrmw33.pvrmw33_b.pvrmw20.pvrmw03.pvrmw34.pvrmw34_b.pvrmw35.pvrmw35_b.pvrerr == 1
/dptutor/model/pet_expet_inu.njJå,Jå<JåPJå/dptutor/model/shadow_exshd.njfid != -1work_buff/dptutor/model/nullzo_beam_exbeam.njerr != -1beam.njm/dptutor/model/lasboss_ex03_boss.njnorm_boss.njm

main_bg.pvrmain_bg02.pvrmain_bg03.pvrmain_bg04.pvrdai_1.pvrdai_2.pvrdai_3_end.pvr/dptutor/model/nullzo_ex/dptutor/model/nullko_ex/dptutor/model/nullsen_ex003_nullzo.njol.njsennin.njnorm_nullzo.njmhagesi_nullzo.njmslow_nullzo.njmkiku_nullzo.njmmigimuku_nullzo.njmmodoru_nullzo.njmdamari_nullzo.njmmigihanasi_nullzo_2.njm1s_hanasi_nullzo.njmodoroki_nullzo.njmyre_nullzo.njmnorm_ol.njmhagesi_ol.njmkiite_ol.njmkami_ol.njmdamari_ol.njmmigimuku_ol.njmmodori_ol.njm1s_hanasi_ol.njmmigihanasi_ol.njmnorm_sennin.njmhagesi_sennin.njmmegane_sennin.njmunazuki_sennin.njmmigimuku_sennin.njmdamari_sennin.njmmodori_sennin.njm1s_hanasi_sennin.njmmigihanasi_sennin.njmnorm_inu.njmsippo_inu.njmhanabura_inu.njmhanatare_inu.njmtut263_2.adxtut001.adxtut002.adxtut003.adxtut004.adxtut005.adxtut006.adxtut007.adxtut008.adxtut009.adxtut010.adxtut011.adxtut012.adxÉ\ÉtÉgÉLÅ[É{Å[ÉhÉnÅ[ÉhÉLÅ[É{Å[Éhtut013.adxtut014.adxtut015.adxÉhÉäÉpÉXÉLÅ[É{Å[Éhtut016.adxtut017.adxtut018.adxtut019.adxtut020.adxtut029.adxtut030.adxtut031.adxëSäpÅiÇ∫ÇÒÇ©Ç≠Åjtut032.adxtut264.adxîºäpÅiÇÕÇÒÇ©Ç≠Åjtut034.adxtut265.adxtut038.adxtut039.adxtut266.adxtut267.adxtut040.adxtut268.adxtut269.adxtut270.adxtut271.adxtut272.adxtut273.adxtut045.adxtut046.adxtut274.adxtut275.adxtut050.adxtut051.adxtut052.adxtut276.adxtut049.adxtut054.adxtut055.adxtut277.adxÉÇÉfÉÄÉ_ÉCÉÑÉãï˚éÆtut057.adxtut058.adxtut059.adxtut278.adxÉÜÅ[ÉUÅ[tut279.adxtut280.adxtut062.adxÉAÉJÉEÉìÉgtut063.adxtut064.adxtut065.adxtut066.adxÉÅÅ[ÉãÉAÉhÉåÉXÉvÉçÉoÉCÉ_Å[tut067.adxtut068.adxtut069.adxtut070.adxtut071.adxtut072.adxtut073.adxÉÅÉãÇ∆LJtut074.adxtut075.adxÉZÉLÉÖÉäÉeÉBtut076.adxtut077.adxtut078.adxtut079.adxtut080.adxtut081.adxtut082.adxtut083.adxtut085.adxtut086.adxÉÅÅ[ÉãÉ{ÉÄtut281.adxtut282.adxtut091.adxtut092.adxtut093.adxtut094.adxtut283.adxtut096.adxtut097.adxtut098.adxtut099.adxtut100.adxtut101.adxtut102.adxÉlÉbÉgÉTÅ[ÉtÉBÉìtut095.adxtut103.adxtut104.adxÉzÅ[ÉÄÉyÅ[ÉWtut105.adxtut106.adxÇtÇqÇkÅiÉÜÅ[ÉAÅ[ÉãÉGÉãÅjÉäÉìÉNtut107.adxåfé¶î¬ÅiÇØÇ¢Ç∂ÇŒÇÒÅjtut109.adxtut110.adxtut111.adxtut112.adxtut113.adxtut114.adxÉ`ÉÉÉbÉgtut115.adxtut116.adxtut284.adxtut118.adxtut119.adxtut285.adxtut121.adxtut122.adxtut286.adxtut287.adxtut128.adxtut129.adxtut132.adxtut288.adxtut134.adxtut135.adxtut136.adxtut137.adxtut138.adxtut289.adxtut290.adxtut291.adxtut142.adxtut143.adxtut144.adxtut145.adxtut146.adxtut147.adxtut148.adxtut149.adxtut150.adxtut151.adxtut292.adxtut153.adxtut154.adxtut155.adxtut293.adxtut158.adxtut159.adxtut294.adxtut161.adxtut162.adxtut295.adxtut163.adxtut164.adxtut165.adxtut166.adxtut167.adxtut168.adxtut296.adxtut171.adxtut172.adxtut173.adxtut174.adxtut175.adxtut176.adxtut177.adxtut178.adxtut179.adxtut180.adxtut181.adxtut182.adxtut183.adxtut184.adxtut185.adxtut186.adxtut187.adxtut188.adxtut189.adxtut190.adxbmpdream\tutorial\prt_dbg.cbuffer(9dream\tutorial\prt_naru.c/dptutor/pvr/naruheso/nar01.pvrnar02.pvrnar03.pvrerr == 1/dptutor/
/dptutor/model/pet_expet_inu.njerr != -1
/dptutor/model/nullzo_ex003_nullzo.nj
/dptutor/model/shadow_exshd.njÄ?fff?öôY?33S?

http://www.sega.co.jp/norm_inu.njm
sippo_inu.njm hanabura_inu.njm hanatare_inu.njm norm_nullzo.njm hanasi2_nullzo.njm hanasi3_nullzo.njm

/dptutor/pvr/quiz/battle001.pvrbattle002.pvrba_bg1.pvrba_bg2.pvrba_moji.pvrerr == 1dream\tutorial\prt_quiz.c/dptutor/
/dptutor/model/car_ex05_car_body.njerr != -1tama.njtama.njm/dptutor/model/shadow_exshd.nj/dptutor/model/pet_expet_inu.njmb_tama.njmb_tama.njmbeam_docter.njs/dptutor/model/bosseffect_exeffect07_bos_effe.njeffect07_bos_effe.njmeffect07_bos_effe.njs

eff01.pvreff02.pvreff03.pvreff04.pvreff05.pvreff06.pvreff07.pvreff08.pvreff09.pvreff10.pvreff11.pvreff12.pvreff13.pvreff14.pvreffb00.pvreffb01.pvreffb02.pvreffb03.pvreffb04.pvreffb05.pvreffb06.pvreffb07.pvreffb08.pvreffb09.pvreffb10.pvreffb11.pvreffb12.pvreffb13.pvreffb14.pvr/dptutor/model/eggman_ex/dptutor/model/deb_ex/dptutor/model/dr_ex/dptutor/model/lasboss_ex004_eggman.nj003_deb.njdocter.nj03_boss.njnorm_car_body.njmatc_car_body.njmyre_car_body.njmnorm_eggman.njmatc_eggman.njmyre_eggman.njmnorm_deb.njmatk_deb.njmyar_deb.njmnorm_docter.njmatc_docter.njmyre_docter.njmnorm_boss.njmatc_boss.njmyre_boss.njmnorm_inu.njmsippo_inu.njmhanabura_inu.njmhanatare_inu.njm/FontSystemFontS16EU04P.DATS18EU04P.DATS20EU04P.DATS24EU04P.DATS26EU04P.DAT*softkey.euro_small*softkey.euro_caps*softkey.func*softkey.face*softkey.symbol*softkey.accent.a*softkey.accent.c*softkey.accent.d*softkey.accent.e*softkey.accent.i*softkey.accent.n*softkey.accent.o*softkey.accent.p*softkey.accent.s*softkey.accent.u*softkey.accent.y*softkey.accent.caps_A*softkey.accent.caps_C*softkey.accent.caps_D*softkey.accent.caps_E*softkey.accent.caps_I*softkey.accent.caps_N*softkey.accent.caps_O*softkey.accent.caps_P*softkey.accent.caps_S*softkey.accent.caps_U*softkey.accent.caps_Y*softkey.euro_hkb*softkey.bg.dk.std*softkey.bg.dk.top*softkey.bg.dk.middle*softkey.bg.dk.bottom*standard*wide*3wide*del*s2x2large*s9wide*ext*sub*s2wide*hkb_caps*accent*mode_onmode_on*disableddisabled*left_arrow*right_arrow*up_arrow*down_arrow*exit*space*enter*delete*back*copy*paste*func01*func02*func03*func04*func05*func06*func07*func08*func09*func10*func11*func12*caps*small*cast.appbg.paleblue*cast.appbg.pink*dialog.dialer0120*dialog.finalize|DREAMKEY.SY2*cast.appbg.paleblue*dialog.pref.main*dialog.modem*dialog.help*dialog.modem.advanced*dialog.pref.browser*dialog.pref.key*dialog.pref.fkey1*dialog.pref.fkey2*dialog.account.telno*dialog.account.net1Automatic%d.%d.%d.%d%s:%d*dialog.account.net2*dialog.account.net3*dialog.account.net4*dialog.account.save*dialog.account.saveack*dialog.account.saving*dialog.register.1*dialog.help*cast.appbg.pink*dialog.register.2Select your country.SÈlectionnez votre pays.W‰hlen Sie Ihr Land.Seleccione su paÌs.Selezionate il vostro paese.Veldu landi ˛itt.Valitse maasi.V‰lg ditt land.V‰lj ditt land.VÊlg dit land.Kies uw land.SÈletionnez votre pays.Escolha o seu paÌs.PWBrowserDEBUG: %s(%d)
custom\ppcomdev.cDEBUG: %s(%d)
pppcon\pppapi.clڌDEBUG: %s(%d)
tcppapi\tcppapi.c
USER PASS LIST
DELEQUITTOPRETR
.
HELOMAIL FROM:<>DATA.
.RCPT TO:<base64quoted-printableuuencodex-uubinhexapplication/mac-binhex40text
Found this line:
(This file must be converted with BinHex 4.0)

My understanding the information:

The client uses auth01.dricas.com for authentication and uses  /cgi-bin/auth.cgi
commodity:%s user:%s pass:%s
To authenticate it self on the server. If everything is correct it will continue to the
Main server:
contacting to GateServer %s:%d(tcp)
nickname has been changed: %s
LobbyServer logged in
LobbyServer added, [%d]%s address: %s:%d0123456789ABCDEF:%s :%s :%s :%s :%d :%d%s %d %d %s SPECTATORNORMAL:#%s %s%s %s%s %s %s%d%s %d %d

The game uses these Domain
daytona.web.dreamcast.com
and
auth01.dricas.com

 

found out that F355 challenge got the same host and PSO also
That is all i could find in the DAYNET.BIN.

I think DAYNET is the way to explore if we want to login.

The Key files where located in this folder:
/key/vm_data/data/

Found Files/folders for the daytona.web.dreamcast.com and auth01.dricas.com
/index1.html
/index2.html
/cgi-bin/auth.cgi (https://metacpan.org/pod/CGI::Auth::Auto)
/key/vm_data/data/

VMS Info:
file remove:-rw-r–r– 1 daytona daytona 1744 Sep 19 08:53 00020443.VMS

Landing page for Daytona USA CD
StartPage=file:/dpwww/index.htm

Also tried the Jap version of Daytona USA 2001.

This one don’t request the KEY file.
Time to get the translation skill back:
But there is nothing to translate because it says the same thing as for the English version.

DreamPi Log when connected:

[585]: Call answered!
[585]: INFO:dreampi:Call answered!
pppd[6515]: pppd 2.4.7 started by root, uid 0
pppd[6515]: using channel 44
pppd[6515]: Using interface ppp0
pppd[6515]: Connect: ppp0 <–> /dev/ttyACM0
pppd[6515]: sent [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0xd2d44039> <pcomp> <accomp>]
[585]: INFO:dreampi:Connected
Serial interface terminated
[585]: Serial interface terminated
MAC address: 08c6b6aece7105b663b44f6ae2aaa781e1f3e6c594155654d643f8008d3b4cfb
pppd[6515]: rcvd [LCP ConfAck id=0x1 <asyncmap 0x0> <magic 0xd2d44039> <pcomp> <accomp>]
[585]: INFO:dcnow:MAC address: 08c6b6aece7105b663b44f6ae2aaa781e1f3e6c594155654d643f8008d3b4cfb
dnsmasq[840]: query[A] dcnow-2016.appspot.com from 127.0.0.1
dnsmasq[840]: cached dcnow-2016.appspot.com is 216.58.206.148
dnsmasq[840]: query[AAAA] dcnow-2016.appspot.com from 127.0.0.1
dnsmasq[840]: cached dcnow-2016.appspot.com is 2a00:1450:4009:817::2014
pppd[6515]: rcvd [LCP ConfReq id=0x2 <mru 1500> <asyncmap 0xa0000> <magic 0x1237b478>]
pppd[6515]: sent [LCP ConfAck id=0x2 <mru 1500> <asyncmap 0xa0000> <magic 0x1237b478>]
pppd[6515]: sent [IPCP ConfReq id=0x1 <compress VJ 0f 01> <addr 192.168.1.99>]
pppd[6515]: rcvd [IPCP ConfReq id=0x3 <compress VJ 0f 01> <addr 0.0.0.0> <ms-dns1 0.0.0.0> <ms-dns2 0.0.0.0>]
pppd[6515]: sent [IPCP ConfNak id=0x3 <addr 192.168.1.98> <ms-dns1 192.168.1.99> <ms-dns2 192.168.1.99>]
pppd[6515]: rcvd [IPCP ConfAck id=0x1 <compress VJ 0f 01> <addr 192.168.1.99>]
pppd[6515]: rcvd [IPCP ConfReq id=0x4 <compress VJ 0f 01> <addr 192.168.1.98> <ms-dns1 192.168.1.99> <ms-dns2 192.168.1.99>]
pppd[6515]: sent [IPCP ConfAck id=0x4 <compress VJ 0f 01> <addr 192.168.1.98> <ms-dns1 192.168.1.99> <ms-dns2 192.168.1.99>]
pppd[6515]: found interface eth0 for proxy arp
pppd[6515]: local IP address 192.168.1.99
pppd[6515]: remote IP address 192.168.1.98
pppd[6515]: Script /etc/ppp/ip-up started (pid 6527)
pppd[6515]: Script /etc/ppp/ip-up finished (pid 6527), status = 0x0

Also if i look at Dreamcast.online:

<Magic 0x1237b478> Daytona USA 2001
Need to check this because don’t know what the magic value is for.
<Magic  0x1207d38> Daytona USA
<Magic 0xa15067a2> Web Browser XDP DREAMS LIMITED EDTION

Some ript PVR files:

 

 

 

 

Finally captured some packets:

There are 3 ips that got my attention and  they are ICMP protocol…
And they using 1024 as destination port. like al of these other:

IP                               source port
120.33.229.151:36144 Registered by APNIC1
122.118.21.37:6881 Registered by APNIC1
64.121.17.82:50322
74.56.230.61:62282
76.71.110.98:1024
84.30.78.124:57291
91.122.48.96:6889
94.230.161.70:47375
109.173.116.183:45141
130.180.61.140:6889
139.47.67.141:6028
142.112.192.11:53411
185.50.223.244:62348

Some other sniffed Ips and ports:

163.172.83.152:45611 uses 123 for dest port. (Paris France)
85.57.40.101:32802 USES 62714 for dest port(Spain)
172.58.157.90:61403 USES 62714 for dest port (USA)
87.101.116.109:13170 USES 62714 for dest port (Budapest)
190.101.104.137:44904  USES 62714 for dest port

But I think tcp is the way to check because traffic needs to report <=> and tcp is
more reliable then UDP so: For TCP i got this IP only
208.213.61.207  also used 9500 Registered by ARIN
Source Port: 37126
tried 3 captures and the TCP ip is only consistent so I Am quite sure its was on that IP and port.
208.213.61.207:37126 on 9500

also dig into auth01.dricas.com:

More detailed mail exchanger (MX) records

Preference	Exchange	IPv4	IPv6	TTL
20	mailsv1.dricas.com	218.42.136.190	?	3600
10	mailtest.isao.net	218.42.137.135	?	3600

 

Just a reminder for me 😀

Dreampi DNS config:
home/pi/dreampi/etc/dnsmasq.conf
Things enabled:

 

Things to know:

Dreamcast.online > dcnow-2016.appspot.com
dreamcast.online is 216.239.32.21 ipv6> 2001:4860:4802:34::15

DNS that DreamPi Uses > x1
using nameserver 46.101.91.123#53

 

 

 

dricas.com=”218.42.136.135″
ip.host contains “218.42.136.135”