PretendoNetwork / nex-viewer

Utility for parsing and (eventually) viewing NEX connections from WireShark network dumps
8 stars 5 forks source link

[Feature]: Add `chls` packet dump support (Charles Sessions) #30

Open jonbarrow opened 2 months ago

jonbarrow commented 2 months ago

Checked Existing

What feature do you want to see added?

Add the ability to load chls dumps into the viewer and display their (relevant) contents.

Why do you want to have this feature?

With Nintendo Network shut down the only (legitimate) way to get new dumps for NEX servers is to dump the traffic from a Switch. The Switch uses NEXv4 with PRUDPLite, which is sent over WebSockets rather than a UDP connection, meaning that using standard HTTP proxy servers like Charles are the best way to capture this data.

Currently it is not possible to use any other standard Charles packet format (besides the raw files produced by "Save WebSocket Messages", mentioned in https://github.com/PretendoNetwork/nex-viewer/issues/31) for this purpose. This is because Charles fails to re-encode WebSocket messages correctly when converting the chls dump into something more usable like a chlsj (Charles JSON Session) or HAR (also a JSON file). The WebSocket messages are either no longer encrypted, get corrupted, or are entirely missing (even reopening them in Charles shows this). This means that chls dumps MUST be supported.

This would also be useful for displaying HPP packets, which are sent over HTTP rather than PRUDP

Any other details to share? (OPTIONAL)

Charles uses Java object serialization for chls dumps. This means the raw contents of the Java classes are encoded directly into the file, much like pickle for Python. This is non-trivial to work with as we essentially need to reimplement the entire serialization protocol from scratch in JavaScript. An attempt at this has been started at https://github.com/PretendoNetwork/java.io