WonderGate/bplXX.mopera.ne.jp

For the MobileWonderGate software, NTT DoCoMo operated network servers for validating and redirecting URL requests:

• bpl01.mopera.ne.jp
• bpl02.mopera.ne.jp

These servers listened on TCP port 5555 for request packets in the following format, and issued a response in the same format.

Packet format

Every packet sent from and to the server follows the same format: a global header, followed by an arbitrary number of blocks with their respective headers.

The client expects one block in response from the server.

Header

Offset	Length	Description
0x00	1	Unknown, always 0x01
0x01	1	Header size in bytes, always 0x18
0x02	2	Response type: 0x0000 - not a response 0x0010 - allow 0x0012 - deny 0x0021 - require ID/password 0x0023 - unknown (too large?)
0x04	4	Total packet size in bytes, including all headers and blocks
0x08	4	Unknown
0x0C	4	Unknown
0x10	4	Unknown (216.0.192.1?)
0x14	4	Unknown (255.255.0.0?)

Block header

Blocks typically consist of zero-terminated strings - a final zero appears to be omitted.

Offset	Length	Description
0x00	2	Block size in bytes, including header
0x02	1	Block type: 0x01 - 0x00? byte, followed by requested URL string 0x03 - 0x00? byte, followed by previous URL string (referrer?) 0x11 - ID string, followed by PASS string 0x22 - 0x00? byte, followed by query field name string, followed by query field value string