6,263
edits
Changes
Jump to navigation
Jump to search
Line 1:
Line 1: − + − + − + Line 14:
Line 14: + +
spoofed a streetpass "AP".
StreetPass is a feature that allow your 3DS to connect with other 3DS using WiFi in standby mode.
StreetPass is a feature that allow your 3DS to connect with other 3DS using WiFi in standby mode.
It can be used to share Mii(s) on Mii Plaza for example. Games' StreetPass data is stored on SD card.
It can be used to share Mii(s) on Mii Plaza for example. Games' StreetPass data is stored on SD card. Wifi infrastructure with APs are used to communicate, like WMB and multi-player.
Using Wireshark tool with a WiFi card in monitor mode allow you to see the data used to scan for other 3DS in the range. The below is a broadcast probe request from an 3DS while in standby mode, with SSID "Nintendo_3DS_continuous_scan_000". When in "active" mode, 3DS sends probe requests with arbitrary SSID strings, like "ic[kSvm9s@*cYD>/~IEVj\(fGG;qDo8j". This frame also contains a custom Nintendo tag, it seems to contain unknown console unique data, since the contents of this tag from different 3ds captures don't match.
Using Wireshark tool with a WiFi card in monitor mode allow you to see the data used to scan for other 3DS in the range. The below is a broadcast probe request from an 3DS while in standby mode, with SSID "Nintendo_3DS_continuous_scan_000". When in "active" mode, 3DS sends probe requests with arbitrary random SSID strings, like "ic[kSvm9s@*cYD>/~IEVj\(fGG;qDo8j". This frame also contains a custom Nintendo tag, it seems to contain unknown console unique data, since the contents of this tag from different 3ds captures don't match.
When in standby mode, ds-mode NTR wifi is used,(this includes SpotPass and StreetPass) but in "active" mode the regular TWL wifimmc bus is used.
When in standby mode, old DS wifi is used,(this includes SpotPass and StreetPass) but in "active" mode the regular DSi wifi bus is used.
0000 00 00 1a 00 2f 48 00 00 19 7d 19 de 2a 00 00 00 ..../H...}..*...
0000 00 00 1a 00 2f 48 00 00 19 7d 19 de 2a 00 00 00 ..../H...}..*...
0060 30 48 60 6c dd 15 00 1f 32 01 11 05 00 02 08 00 0H`l....2.......
0060 30 48 60 6c dd 15 00 1f 32 01 11 05 00 02 08 00 0H`l....2.......
0070 00 f0 08 c8 34 6e 05 0f c9 c6 80 5b 6f bc 5a ....4n.....[o.Z
0070 00 f0 08 c8 34 6e 05 0f c9 c6 80 5b 6f bc 5a ....4n.....[o.Z
A streetpass "AP" was spoofed on a laptop with hostapd by setting the SSID to "Nintendo_3DS_continuous_scan_000", with the extra Nintendo tag from another 3DS' probe request. The SSID and AP can't be easily spoofed with hostapd for streetpass when 3DS is "active", for the random "ic[kSvm9s@*cYD>/~IEVj\(fGG;qDo8j" strings. The 3DS didn't seem to authenticate or associate with the "AP". Streetpass "AP" comms use WPA2 [http://en.wikipedia.org/wiki/CCMP CCMP] encryption. Eventually the 3DS stops communicating with the fake "AP" since the AP doesn't understand the sent data,(especially since it's encrypted) and sends a 802.11 "Action" frame, with category ID 0x7f and Nintendo's vendor ID: 00 1f 32.(However the 3DS keeps communicating with the above process repeatedly)
[[Category:Nintendo Software]]
[[Category:Nintendo Software]]