3dbrew

StreetPass: Difference between revisions

← Older edit
Sorunome (talk | contribs)
Trusted
56 edits
m Fix typo
 
(7 intermediate revisions by 3 users not shown)
Line 56: Line 56:
==== Nintendo Tag Format ====
==== Nintendo Tag Format ====


The offsets, in bytes, mentioned in the table below start at the beginning of the Nintendo tag ID, which is variable in length, and can be found right after the Vendor Specific OUI type of the 802.11 frame, which is often seen as a byte of "01". Each one of the elements are discussed in more detail after the table. Note that this table represents a current theory on what each of the fields represent, with the argument stated in the corresponding sections.
The offsets, in bytes, mentioned in the table below start at the beginning of the Nintendo tag ID, which is variable in length, and can be found right after the Vendor Specific OUI type of the 802.11 frame, which is often seen as a byte of "01". Each one of the elements are discussed in more detail after the table. Note that this table represents a current theory on what each of the fields represent, with the argument stated in the corresponding sections. It seems to follow a "Type–length–value" structure.


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 68: Line 68:
|  0x00
|  0x00
|  0x01
|  0x01
|  '''Protocol Identification'''
|  '''StreetPass Service Tag'''
|  May be for protocol identification. All captures thus far show this value at 17, hexadecimal 11.
|  The identifier of the StreetPass Service. All captures thus far show this value at 17, hexadecimal 11.
| 11
| 11
|-
|-
Line 84: Line 84:
|  00 02 08 00 00
|  00 02 08 00 00
|-
|-
|  varies
|  -0x10
|  0x02
|  0x1
|  '''Unknown'''
|  '''StreetPass consoleID Tag'''
|  At the end of the StreetPass Services field is a two byte field that is the same among all devices thus far. Its purpose is unknown.
|  The identifier of the StreetPass consoleID, it is always the same value.
|  f0 08
|  f0
|-
|  -0x09
|  0x01
|  '''StreetPass consoleID Length'''
|  The length of the StreetPass consoleID field, which is also always the same value.
|  08
|-
|-
|  -0x08
|  -0x08
Line 97: Line 103:
|}
|}


===== Protocol Version =====
===== StreetPass Service Tag =====


Appears to represent a protocol version, or device identification. This field remains consistent on all devices, despite variable enabled StreetPass services or length of the tag. Could also represent region.
This field indicates that the following data is of type StreetPass services. It is the same across all devices.


===== StreetPass Service Length =====
===== StreetPass Service Length =====
Line 113: Line 119:
   Sims 3: 00 03 65 00 30
   Sims 3: 00 03 65 00 30
   Street Fighter: 00 03 05 00 02 (FF FF FF FF FF FF)
   Street Fighter: 00 03 05 00 02 (FF FF FF FF FF FF)
  Tomodachi life: 00 08 C5 00 30 (Tested on EUR region)
  Animal crossing new leaf: 00 19 8D 00 30 (Tested on EUR region)


The first 4 bytes are the titleID of the service, the last byte seems to contain flags.
The first 4 bytes are the titleID of the service, the last byte seems to contain flags.
Line 126: Line 134:


Only the bits 2,5,6 were used.
Only the bits 2,5,6 were used.
When set, the bit n°2 indicates the presence of a followinf 6-byte field filled with 0xff.


Some services have a 6-byte field succeeding the StreetPass service that is just FF bytes (e.g. FF FF FF FF FF FF). The purpose of these is unknown, although may be used as data for a service, or as separator of some sort for different types of StreetPass services.
Bits n°5 and n°6 encode the send method of the service:
 
{| class="wikitable" border="1"
!ID!!Send Mode!!Description
|-
|0b00||EXCHANGE||StreetPass message exchange will only happen if both consoles can store the message of the other. E.g. the inbox isn't full. Example title: StreetPass Mii Plaza
|-
|0b01||RECV_ONLY||3DS is only receiving messages. Some services mark their messages with this send mode (e.g. 000AF700)
|-
|0b10||SEND_ONLY||3DS inbox is full so it is only sending messages.
|-
|0b11||SEND_RECV||The 3DS can send and receive messages of this service
|}
 
When set, the bit n°2 indicates the presence of a following 6-byte field filled with 0xff. The purpose of these is unknown, although may be used as data for a service, or as separator of some sort for different types of StreetPass services.


Observed services (leading titleID 0x00 removed, 6*0xff ignored) on 68K probe requests between 2013-08-24 and 2014-06-29 in various european locations.
Observed services (leading titleID 0x00 removed, 6*0xff ignored) on 68K probe requests between 2013-08-24 and 2014-06-29 in various european locations.
Line 388: Line 409:
|}
|}


===== Unknown 2-byte Field =====
===== StreetPass consoleID Tag =====
 
It has remained the same across all devices thus far, '''f0'''. It identifies the StreetPass consoleID field.
 
===== StreetPass consoleID Length =====


The purpose of this field is not known yet. It has remained the same across all devices thus far. The value has always been observed as '''f008'''.
Since the StreetPass consoleID length is always 0x08, this field is always '''08'''.


===== StreetPass consoleID =====
===== StreetPass consoleID =====
Line 408: Line 433:
The 3DS (#1) that the Initial Probe Response is directed to will send an 802.11 Action frame back to the device. The sequence numbers at this point stop stepping up by 3, and instead increase by one based from each originating device's SN. It will then send another Probe Request, this time sent directly to the responding 3DS (#2) by specifying its MAC address in the destination field, and setting its own MAC address in the source address field. It also does not have a SSID specified in the frame, except the frame will contain a BSSID with the value of the 3DS (#2) that responded to the initial Probe, and thus acts as the master in the 802.11 exchange.
The 3DS (#1) that the Initial Probe Response is directed to will send an 802.11 Action frame back to the device. The sequence numbers at this point stop stepping up by 3, and instead increase by one based from each originating device's SN. It will then send another Probe Request, this time sent directly to the responding 3DS (#2) by specifying its MAC address in the destination field, and setting its own MAC address in the source address field. It also does not have a SSID specified in the frame, except the frame will contain a BSSID with the value of the 3DS (#2) that responded to the initial Probe, and thus acts as the master in the 802.11 exchange.


=== Send Mode ===
=== Encrypted conversation ===
The 3DS can mark StreetPass data with one of 4 Send Modes
 
{| class="wikitable" border="1"
After the handshake is done, both 3DS start having an encrypted conversation. Its format and protocols can be seen at [[SPTCP]] and [[SPMTP]].
!ID!!Send Mode!!Description
|-
|0||EXCHANGE||StreetPass message exchange will only happen if both consoles can store the message of the other. E.g. the inbox isn't full. Example title: StreetPass Mii Plaza
|-
|1||RECV_ONLY||3DS doesn't have anything in its outbox so it is only receiving messages.
|-
|2||SEND_ONLY||
|-
|3||SEND_RECV||
|}


== StreetPass Spoofing ==
== StreetPass Spoofing ==
Retrieved from "https://www.3dbrew.org/wiki/StreetPass"