Difference between revisions of "StreetPass"

From 3dbrew
Jump to navigation Jump to search
(Fill in structs for streetpass messages)
 
Line 500: Line 500:
 
The body is expected to contain binary data with the same structure as the spr-slotXX files in the request. The order of these must be the same as the reponse header order.
 
The body is expected to contain binary data with the same structure as the spr-slotXX files in the request. The order of these must be the same as the reponse header order.
  
 +
== Structs, Data Types ==
 +
Streetpass uses multiple different structs and data types for storing and transporting data.
 +
 +
=== MessageId ===
 +
This datatype holds a per-console-per-title unique message id.
 +
{| class="wikitable" border="1"
 +
! Type
 +
! Description
 +
|-
 +
| u8[8]
 +
| The message id
 +
|}
 +
 +
=== Timestamp12 ===
 +
This holds a timestamp in 12 bytes
 +
{| class="wikitable" border="1"
 +
! Offset
 +
! Size
 +
! Type
 +
! Name
 +
|-
 +
| 0x0
 +
| 0x4
 +
| u32
 +
| Year
 +
|-
 +
| 0x4
 +
| 0x1
 +
| u8
 +
| Month
 +
|-
 +
| 0x5
 +
| 0x1
 +
| u8
 +
| Day
 +
|-
 +
| 0x6
 +
| 0x1
 +
| u8
 +
| Weekday
 +
|-
 +
| 0x7
 +
| 0x1
 +
| u8
 +
| Hour
 +
|-
 +
| 0x8
 +
| 0x1
 +
| u8
 +
| Minute
 +
|-
 +
| 0x9
 +
| 0x1
 +
| u8
 +
| Second
 +
|-
 +
| 0xA
 +
| 0x2
 +
| u16
 +
| Millisecond
 +
|}
 +
 +
=== Message (0x6060) ===
 +
MessageHeader:
 +
{| class="wikitable" border="1"
 +
! Offset
 +
! Size
 +
! Type
 +
! Name
 +
! Description
 +
|-
 +
| 0x00
 +
| 0x2
 +
| u16
 +
| magic
 +
| Equals 0x6060 (<code>``</code>)
 +
|-
 +
| 0x02
 +
| 0x2
 +
| u16
 +
| Padding
 +
|
 +
|-
 +
| 0x04
 +
| 0x04
 +
| u32
 +
| message_size
 +
| The size in bytes of the entire message, including all headers and hmac
 +
|-
 +
| 0x08
 +
| 0x04
 +
| u32
 +
| total_header_size
 +
| The size in bytes of all headers, including the extra headers
 +
|-
 +
| 0x0C
 +
| 0x04
 +
| u32
 +
| body_size
 +
| The size in bytes of the body of the message
 +
|-
 +
| 0x10
 +
| 0x04
 +
| u32
 +
| title_id
 +
| The title id of the message
 +
|-
 +
| 0x14
 +
| 0x04
 +
| u32
 +
| title_id2
 +
| ???
 +
|-
 +
| 0x18
 +
| 0x04
 +
| u32
 +
| batch_id
 +
| The sending client sets an ID here if multiple messages should be batched together into one transaction
 +
|-
 +
| 0x1C
 +
| 0x04
 +
| u32
 +
| transfer_id
 +
| ???
 +
|-
 +
| 0x20
 +
| 0x08
 +
| MessageId
 +
| message_id
 +
| The ID of the sending message
 +
|-
 +
| 0x28
 +
| 0x04
 +
| u32
 +
| message_version
 +
| ???
 +
|-
 +
| 0x2C
 +
| 0x08
 +
| MessageId
 +
| message_id_2
 +
| The message ID that this message is referring to, e.g. the individual responses in Streetpass Mii Plaza
 +
|-
 +
| 0x34
 +
| 0x01
 +
| u8
 +
| flags
 +
| ???
 +
|-
 +
| 0x35
 +
| 0x01
 +
| SendMethod
 +
| send_method
 +
|
 +
|-
 +
| 0x36
 +
| 0x01
 +
| bool
 +
| unopened
 +
| Set if the message hasn't been opened yet
 +
|-
 +
| 0x37
 +
| 0x01
 +
| bool
 +
| is_new
 +
| Set if the message is new
 +
|-
 +
| 0x38
 +
| 0x08
 +
| u64
 +
| sender_id
 +
|
 +
|-
 +
| 0x40
 +
| 0x08
 +
| u64
 +
| sender_id_2
 +
|
 +
|-
 +
| 0x48
 +
| 0x0C
 +
| Timestamp12
 +
| sent
 +
|
 +
|-
 +
| 0x54
 +
| 0x0C
 +
| Timestamp12
 +
| received
 +
|
 +
|-
 +
| 0x60
 +
| 0x0C
 +
| Timestamp12
 +
| created
 +
|
 +
|-
 +
| 0x6C
 +
| 0x01
 +
| u8
 +
| send_count
 +
| How often this message can be sent
 +
|-
 +
| 0x6D
 +
| 0x01
 +
| u8
 +
| forward_count
 +
| How often this message can be forwarded
 +
|-
 +
| 0x6E
 +
| 0x02
 +
| u16
 +
| user_data
 +
| ???
 +
|}
 +
 +
ExtMessageHeader:
 +
{| class="wikitable" border="1"
 +
! Offset
 +
! Size
 +
! Type
 +
! Name
 +
! Description
 +
|-
 +
| 0x00
 +
| 0x04
 +
| u32
 +
| type
 +
| The type of the extra header
 +
|-
 +
| 0x04
 +
| 0x04
 +
| u32
 +
| size
 +
| Size, in bytes, of the extra header
 +
|-
 +
| 0x08
 +
|
 +
|
 +
| body
 +
| The body of the extra header
 +
|}
 +
 +
Message:
 +
{| class="wikitable" border="1"
 +
! Offset
 +
! Size
 +
! Type
 +
! Name
 +
! Description
 +
|-
 +
| 0x00
 +
| 0x70
 +
| MessageHeader
 +
| header
 +
| The header of the message
 +
|-
 +
| 0x70
 +
|
 +
| ExtMessageHeader[]
 +
| ext_headers
 +
| An array of the extra headers for the message. The array keeps filling until the length no more until <code>header.total_header_size</code>
 +
|-
 +
|
 +
|
 +
|
 +
| body
 +
| The actual body/payload of the message
 +
|-
 +
|
 +
| 0x20
 +
| u8[0x20]
 +
| hmac
 +
| The hmac over the body with the hmac_key
 +
|}
 +
 +
=== Slot (0x6161) ===
 +
The slot groups multiple messages of one title id together into a single struct
 +
{| class="wikitable" border="1"
 +
! Offset
 +
! Size
 +
! Type
 +
! Name
 +
! Description
 +
|-
 +
| 0x00
 +
| 0x02
 +
| u16
 +
| magic
 +
| Equals 0x6161 (<code>aa</code>)
 +
|-
 +
| 0x02
 +
| 0x02
 +
| u16
 +
| padding
 +
|
 +
|-
 +
| 0x04
 +
| 0x04
 +
| u32
 +
| size
 +
| The size of bytes of the entire slot, including the header and all messages it contains
 +
|-
 +
| 0x08
 +
| 0x04
 +
| u32
 +
| title_id
 +
| The title id of the slot
 +
|-
 +
| 0x0C
 +
| 0x04
 +
| u32
 +
| batch_id
 +
| If the slot contains batched messages, the batch id is set to the same one as those messages
 +
|-
 +
| 0x10
 +
| 0x04
 +
| u32
 +
| message_count
 +
| The total number of messages in this slot
 +
|-
 +
| 0x14
 +
|
 +
| Message[]
 +
| messages
 +
| An array of length <code>message_count</code> all the messages of this slot
 +
|}
 +
 +
=== BoxInfo (0x6262) ===
 +
{| class="wikitable" border="1"
 +
! Offset
 +
! Size
 +
! Type
 +
! Name
 +
! Description
 +
|-
 +
| 0x00
 +
| 0x02
 +
| u16
 +
| magic
 +
| Equals 0x6262 (<code>bb</code>)
 +
|-
 +
| 0x02
 +
| 0x02
 +
| u16
 +
| padding
 +
|
 +
|-
 +
| 0x04
 +
| 0x04
 +
| u32
 +
| file_size
 +
| The size of the box info in bytes
 +
|-
 +
| 0x08
 +
| 0x04
 +
| u32
 +
| max_box_size
 +
| The maximum allowed size of the box in bytes
 +
|-
 +
| 0x0C
 +
| 0x04
 +
| u32
 +
| box_size
 +
| The current size of the box in bytes
 +
|-
 +
| 0x10
 +
| 0x04
 +
| u32
 +
| max_num_messages
 +
| The maximum number of messages that the box can hold
 +
|-
 +
| 0x14
 +
| 0x04
 +
| u32
 +
| num_messages
 +
| The current number of messages in the box
 +
|-
 +
| 0x18
 +
| 0x04
 +
| u32
 +
| max_batch_size
 +
| The maximum size of a bach, in number of messages
 +
|-
 +
| 0x1C
 +
| 0x04
 +
| u32
 +
| max_message_size
 +
| The maximum size of a message, in bytes
 +
|-
 +
| 0x20
 +
|
 +
| MessageHeader[]
 +
| message_headers
 +
| An array of all message headers in this box of length <code>num_messages</code>
 +
|}
 +
 +
=== MBoxInfo (0x6363) ===
 +
This holds information on the message box, including both inbox and outbox
 +
{| class="wikitable" border="1"
 +
! Offset
 +
! Size
 +
! Type
 +
! Name
 +
! Description
 +
|-
 +
| 0x00
 +
| 0x02
 +
| u16
 +
| magic
 +
| Equals 0x6363 (<code>cc</code>)
 +
|-
 +
| 0x02
 +
| 0x02
 +
| u16
 +
| padding
 +
|
 +
|-
 +
| 0x04
 +
| 0x04
 +
| u32
 +
| title_id
 +
| The title id for this mbox
 +
|-
 +
| 0x08
 +
| 0x04
 +
| u32
 +
| private_id
 +
| ???
 +
|-
 +
| 0x0C
 +
| 0x01
 +
| u8
 +
| mbox_type_flags
 +
| 0x01: normal programs, 0x06: system programs, 0x80: silent notif
 +
|-
 +
| 0x0D
 +
| 0x01
 +
| bool
 +
| enabled
 +
| Weather this message box is enabled
 +
|-
 +
| 0x0E
 +
| 0x02
 +
| u16
 +
| padding
 +
|
 +
|-
 +
| 0x10
 +
| 0x20
 +
| u8[0x20]
 +
| hmac_key
 +
| The hmac key to make hmacs for messages. These are unique per title, however they are the same for all consoles.
 +
|-
 +
| 0x30
 +
| 0x04
 +
| u32
 +
| padding
 +
|
 +
|-
 +
| 0x34
 +
| 0x0C
 +
| Timestamp12
 +
| last_accessed
 +
|
 +
|-
 +
| 0x40
 +
| 0x01
 +
| bool
 +
| flag_unread
 +
| Does this message box contain unread messages?
 +
|-
 +
| 0x41
 +
| 0x01
 +
| bool
 +
| flag_new
 +
| Does this message box contain new messages?
 +
|-
 +
| 0x42
 +
| 0x01
 +
| bool
 +
| flag_unknown
 +
| ???
 +
|-
 +
| 0x43
 +
| 0x01
 +
| bool
 +
| flag_unknown
 +
| ???
 +
|-
 +
| 0x44
 +
| 0x0C
 +
| Timestamp12
 +
| last_received
 +
|
 +
|-
 +
| 0x50
 +
| 0x04
 +
| u32
 +
| padding
 +
|
 +
|-
 +
| 0x54
 +
| 0x0C
 +
| Timestamp12
 +
| unknown_timestamp
 +
| ???
 +
|}
 +
 +
=== 0x6565 ===
 +
SlotMetadata:
 +
{| class="wikitable" border="1"
 +
! Offset
 +
! Size
 +
! Type
 +
! Name
 +
! Description
 +
|-
 +
| 0x00
 +
| 0x04
 +
| u32
 +
| title_id
 +
| The title id of the slot
 +
|-
 +
| 0x04
 +
| 0x04
 +
| SendMethod
 +
| send_method
 +
| The send method for the slot
 +
|-
 +
| 0x08
 +
| 0x04
 +
| u32
 +
| body_size
 +
| The size of the slot body in bytes
 +
|-
 +
| 0x0C
 +
| 0x04
 +
| u32
 +
| count
 +
| Number of messages
 +
|-
 +
| 0x10
 +
| 0x14
 +
| '''unknown'''
 +
| '''unknown'''
 +
|
 +
|}
 +
 +
Struct:
 +
{| class="wikitable" border="1"
 +
! Offset
 +
! Length
 +
! Type
 +
! Name
 +
! Description
 +
|-
 +
| 0x00
 +
| 0x02
 +
| u16
 +
| magic
 +
| Equals 0x6565 (<code>ee</code>)
 +
|-
 +
| 0x02
 +
| 0x02
 +
| u16
 +
| padding
 +
|
 +
|-
 +
| 0x04
 +
| 0x28
 +
| '''unknown'''
 +
| '''unknown'''
 +
|
 +
|-
 +
| 0x2C
 +
| 0x360
 +
| SlotMetadata[0x18]
 +
| slots
 +
| Metadata of all slots
 +
|}
 +
 +
=== OBIndex (0x6767) ===
 +
{| class="wikitable" border="1"
 +
! Offset
 +
! Size
 +
! Type
 +
! Name
 +
! Description
 +
|-
 +
| 0x00
 +
| 0x02
 +
| u16
 +
| magic
 +
| Equals 0x6767 (<code>gg</code>)
 +
|-
 +
| 0x02
 +
| 0x02
 +
| u16
 +
| padding
 +
|
 +
|-
 +
| 0x04
 +
| 0x04
 +
| u32
 +
| num_messages
 +
| The number of messages in the outbox
 +
|-
 +
| 0x08
 +
|
 +
| MessageId[]
 +
| message_ids
 +
| An array of the message IDs in the outbox, of length <code>num_messages</code>
 +
|}
 +
 +
=== MBoxList (0x6868) ===
 +
{| class="wikitable" border="1"
 +
! Offset
 +
! Size
 +
! Type
 +
! Name
 +
! Description
 +
|-
 +
| 0x00
 +
| 0x02
 +
| u16
 +
| magic
 +
| Equals 0x6868 (<code>hh</code>)
 +
|-
 +
| 0x02
 +
| 0x02
 +
| u16
 +
| padding
 +
|
 +
|-
 +
| 0x04
 +
| 0x04
 +
| u32
 +
| version
 +
|
 +
|-
 +
| 0x08
 +
| 0x04
 +
| u32
 +
| num_boxes
 +
| The number of boxes (= games with streetpass enabled)
 +
|-
 +
| 0x0C
 +
| 0x180
 +
| char[0x18][0x10]
 +
| box_names
 +
| A 0x18-long array of all the box names (= hex encoded title ids) of games with streetpass enabled
 +
|}
  
 
[[Category:Nintendo Software]]
 
[[Category:Nintendo Software]]

Latest revision as of 13:23, 2 December 2024

StreetPass is a feature that allows your 3DS to connect with other 3DS consoles using WiFi in standby mode. It can be used to share Mii(s) on Mii Plaza for example. Applications' StreetPass data are stored in the CECD module's NAND savegame, applications can move received StreetPass data to an arbitrary savegame. Wifi infrastructure with APs are used to communicate where the data-frames are encrypted with WPA2 CCMP, like UDS/Download Play.

WiFi Probe Request Frame[edit]

Whenever the 3DS is woken from sleep (or turned on), and WiFi is enabled, it sends out a 802.11 Probe Request which include all saved access points, as well a probe to an SSID containing an arbitrary string of data, such as "ic[kSvm9s@*cYD>/~IEVj\(fGG;qDo8j". This string changes at least daily, and most likely every time the device is woken up.

The MAC address used for these probes is the static MAC address found in the System Settings application. Unlike the StreetPass MAC address, it will not change over time. This MAC address OUI also differs from the one used in StreetPass.

CCMP Key[edit]

The StreetPass local-WLAN CCMP data-encryption key is generated by the StreetPass CECD module, where the CCMP key is the 16-byte output from encrypting an all-zero block with AES-CTR via PS:EncryptDecryptAes, with keytype6. The CTR is the first 0x10-bytes from a SHA1-HMAC hash. The SHA1-HMAC key is a 17-byte text string including the NULL-terminator, a seperate HMAC key is used for retail/dev-units, this is determined via ENVINFO bit0. The data hashed with SHA1-HMAC is a 0x1C-byte buffer, which is described below.

Hash Block[edit]

Offset Size Description
0x0 0x8 8-byte StreetPass consoleID for the host, from the probe frames.
0x8 0x8 8-byte StreetPass consoleID for the client, from the probe frames.
0x10 0x6 MAC address for host.
0x16 0x6 MAC address for client.

StreetPass Exchange[edit]

While StreetPass is enabled, the 3DS constantly sends out Probe Requests with an SSID of "Nintendo_3DS_continuous_scan_000". Unlike beacons, which are actively advertising the device's presence, the 3DS is essentially actively looking for other 3DSes. This design is likely to limit impact to non-3DS WiFi capable devices. Each Probe Request contains basic information about that 3DS, including an identifier, and active StreetPass services. If another 3DS is in range, the second 3DS (#2) will respond with a Probe Response, to which the original 3DS (#1), and of the receiving device with every frame thereafter, will respond with an 802.11 Acknowledgement. 3DS(#1) then sends an 802.11 Action frame, as well as an additional Probe Request. The second 3DS sends back another Probe Response that begins the encrypted exchange between the two devices, no authentication/association is done here.

The MAC address used in sleep-mode seems to change every time there's a StreetPass hit, as well as the last 8-bytes(StreetPass consoleID) of the Nintendo tag data. The MAC address + 8-byte StreetPass consoleID is seen to change every time the user enters and exits and Settings application if they have not had a StreetPass in an observed time period of 24 hours. It is uncertain how the 3DS determines when it can do a StreetPass again with another 3DS, or what information is actually used to track that. It may be related to how long that 3DS was in range constantly/out of range. 3DSes that are constantly in range of each other in sleep-mode, usually do StreetPass every 11 hours.

Probe Request Frame[edit]

Using Wireshark tool with a WiFi card in monitor mode allow you to see the data used to scan for other 3DS in the range. The below is a broadcast probe request from an 3DS while in standby mode, with SSID "Nintendo_3DS_continuous_scan_000". This SSID remains consistent across all 3DS units. This frame also contains a custom variable length Nintendo tag, which contains information regarding the offered StreetPass services. The sequence numbers for these probe request increment by 3 for every probe, until another 3DS responds with a probe response. 

 0000   00 00 1a 00 2f 48 00 00 19 7d 19 de 2a 00 00 00  ..../H...}..*...
 0010   12 16 9e 09 a0 00 c9 02 00 00 40 00 00 00 ff ff  ..........@.....
 0020   ff ff ff ff da 6b f7 22 f3 77 ff ff ff ff ff ff  .....k.".w......
 0030   40 77 00 20 4e 69 6e 74 65 6e 64 6f 5f 33 44 53  @w. Nintendo_3DS
 0040   5f 63 6f 6e 74 69 6e 75 6f 75 73 5f 73 63 61 6e  _continuous_scan
 0050   5f 30 30 30 01 08 82 84 8b 0c 12 96 18 24 32 04  _000.........$2.
 0060   30 48 60 6c dd 15 00 1f 32 01 11 05 00 02 08 00  0H`l....2.......
 0070   00 f0 08 c8 34 6e 05 0f c9 c6 80 5b 6f bc 5a     ....4n.....[o.Z

Nintendo Tag Format[edit]

The offsets, in bytes, mentioned in the table below start at the beginning of the Nintendo tag ID, which is variable in length, and can be found right after the Vendor Specific OUI type of the 802.11 frame, which is often seen as a byte of "01". Each one of the elements are discussed in more detail after the table. Note that this table represents a current theory on what each of the fields represent, with the argument stated in the corresponding sections.

Offset Length Purpose Description Example
0x00 0x01 Protocol Identification May be for protocol identification. All captures thus far show this value at 17, hexadecimal 11. 11
0x01 0x01 StreetPass Service Length Length in bytes of only the StreetPass Services field. 05
0x02 0x05 StreetPass Services Starting at the 0x02 offset, it appears to be a list of StreetPass services, each in length of 5 bytes. This continues on depending on the number of services the user has enabled at the time. 00 02 08 00 00
varies 0x02 Unknown At the end of the StreetPass Services field is a two byte field that is the same among all devices thus far. Its purpose is unknown. f0 08
-0x08 0x08 StreetPass consoleID Seen to change when the Settings app is used if there has not been a StreetPass tag recently. Also may change after each StreetPass hit and system power-off? c8 34 6e 05 0f c9 c6 80
Protocol Version[edit]

Appears to represent a protocol version, or device identification. This field remains consistent on all devices, despite variable enabled StreetPass services or length of the tag. Could also represent region.

StreetPass Service Length[edit]

This field is used to indicate the length of the StreetPass Services field. Removing and adding services has shown this field to increment and decrement in 5 bytes, or 11 bytes depending on the game. The StreetPass Services field has then expanded or reduced accordingly.

StreetPass Services[edit]

The third field in the protocol header appears to be an arbitrary length list of StreetPass services enabled on the device. Each StreetPass service seems to be identified by a 5-byte ID. If you enable or disable services, the number of 5-byte IDs grows and shrinks within this list. Observed service IDs include: 

 Mii Plaza: 00 02 08 00 00
 Ridge Racer: 00 03 58 00 30
 Sims 3: 00 03 65 00 30
 Street Fighter: 00 03 05 00 02 (FF FF FF FF FF FF)

The first 4 bytes are the titleID of the service, the last byte seems to contain flags.

The last byte (flags) have been observed between those possibilities : 

 00000000
 00000010
 00010000
 00100000
 00110000
 00110010

Only the bits 2,5,6 were used. When set, the bit n°2 indicates the presence of a followinf 6-byte field filled with 0xff.

Some services have a 6-byte field succeeding the StreetPass service that is just FF bytes (e.g. FF FF FF FF FF FF). The purpose of these is unknown, although may be used as data for a service, or as separator of some sort for different types of StreetPass services.

Observed services (leading titleID 0x00 removed, 6*0xff ignored) on 68K probe requests between 2013-08-24 and 2014-06-29 in various european locations.

The fact that a same titleID can have different flags should be noted. 

 0db6-00100000 5
 0db6-00110000 20
Occurrences TitleID Flags
131 0208 00000000
58 0516 00010000
56 053f 00100000
55 0306 00100000
44 0862 00110000
26 09f1 00110000
20 0db6 00110000
18 0516 00110000
18 0205 00110010
17 0ec4 00110000
17 0300 00110000
16 055d 00110000
13 08d3 00010000
13 053b 00100000
12 0916 00100000
12 07ad 00100000
12 0306 00110000
12 0300 00100000
11 0916 00110000
9 0b1d 00110000
8 0ec4 00100000
7 080f 00110000
7 07c8 00100000
6 038a 00100000
5 0f30 00110000
5 0db6 00100000
5 0910 00110000
5 0862 00100000
5 053f 00110000
5 0522 00110000
4 07ad 00110000
3 0ae2 00110000
3 09f1 00100000
3 08c5 00110000
3 038c 00000000
3 033b 00100000
3 030b 00100000
2 0ba9 00110000
2 0a53 00110000
2 08d3 00100000
2 07ad 00010000
2 0751 00110000
2 0402 00100000
1 0f82 00110000
1 0f5b 00110000
1 0e7f 00110000
1 0bff 00110000
1 0b1d 00100000
1 0ad6 00010000
1 0a90 00110000
1 0a05 00100000
1 073c 00110000
1 06da 00100000
1 05aa 00110000
1 05a5 00110000
1 053b 00110000
1 04ca 00110000
1 038a 00110000
1 033b 00110000
1 030b 00110000
1 0305 00000010
Unknown 2-byte Field[edit]

The purpose of this field is not known yet. It has remained the same across all devices thus far. The value has always been observed as f008.

StreetPass consoleID[edit]

When there's a StreetPass hit, and no StreetPass data changed on either of the 3DSes, no data is transferred besides probes? After turning off power, then powering on and entering sleepmode, the MAC doesn't change from prior to power off but the last 8-bytes of the Nintendo tag changes. This tag has been seen to not be sequential over time. After one of the new StreetPass content is handled, (running one of the StreetPass titles etc) this 8-byte StreetPass consoleID changes?

Initial Probe Response Frame[edit]

If a 3DS (#2) receives another device's probe request and has not yet tagged that device in an arbitrary amount of time (~12 hours), the receiving 3DS (#2) will respond with a Probe Response frame. The destination MAC address is the StreetPass MAC address of the 3DS (#1) that was transmitting the probe request, while the receiving device sets its StreetPass MAC address as the source address. This is important to note because further exchanges may cease using destination and/or source addresses.

In the probe response, the 3DS (#2) appears to offer a channel of 1, 6, or 11. Different channels have been seen offered between the same set of 3DS for each StreetPass. Offered channels, and channel range most likely varies by region.

The StreetPass Probe Response frame contains the same Nintendo tag in Probe Requests of the device that is transmitting the Probe Response frame.

Subsequent Probe Request and Response Frames[edit]

The 3DS (#1) that the Initial Probe Response is directed to will send an 802.11 Action frame back to the device. The sequence numbers at this point stop stepping up by 3, and instead increase by one based from each originating device's SN. It will then send another Probe Request, this time sent directly to the responding 3DS (#2) by specifying its MAC address in the destination field, and setting its own MAC address in the source address field. It also does not have a SSID specified in the frame, except the frame will contain a BSSID with the value of the 3DS (#2) that responded to the initial Probe, and thus acts as the master in the 802.11 exchange.

Send Mode[edit]

The 3DS can mark StreetPass data with one of 4 Send Modes

ID Send Mode Description
0 EXCHANGE StreetPass message exchange will only happen if both consoles can store the message of the other. E.g. the inbox isn't full. Example title: StreetPass Mii Plaza
1 RECV_ONLY 3DS doesn't have anything in its outbox so it is only receiving messages.
2 SEND_ONLY
3 SEND_RECV

StreetPass Spoofing[edit]

A streetpass "AP" was spoofed with hostapd by setting the SSID to "Nintendo_3DS_continuous_scan_000", with the extra Nintendo tag from another 3DS' probe request. Like 3DS<>3DS communications, the 3DS didn't authenticate or associate with the host. Streetpass communications use CCMP encryption. Eventually the 3DS stops communicating with the host since the host doesn't reply to any of the data frames, then sends a 802.11 "Action" frame, with category ID 0x7f and Nintendo's vendor ID: 00 1f 32.(However the 3DS keeps communicating with the above process repeatedly) Communication with two 3DSes are the same as above except there's actual encrypted data sent to/from both consoles, unlike the fake host.

StreetPass Relay[edit]

This feature was implemented in version 6.2.0-12.

It was probably controlled over the SpotPass#policylist. When connecting to a Nintendo Zone Hotspot the console will send an additional GET parameter named ap. Adding the following priority to the policylist will instruct the console to upload its data (The level tag can probably be lower and must not be HIGH). 

  <Priority>
    <TitleId>0004013000003400</TitleId>
    <TaskId>sprelay</TaskId>
    <Level>HIGH</Level>
    <Persistent>false</Persistent>
    <Revive>false</Revive>
  </Priority>

Request[edit]

The following additional headers will be send in the request:

X-Boss-Apinfo Access Point Info. The same number that is send with the policylist GET parameter ap. Probably identifies the SSID of connected Nintendo Zone Hotspot. If not connected to Nintendo Zone Hotspot this will be an empty string. 02012600000
X-Boss-Bssid The MAC address of the access point the 3DS is connected to. 11:22:33:44:55:66
X-Boss-Country 2 letter country code of the set language. ES
X-Boss-Region 3 letter region code of the 3DS' region. EUR
X-Boss-Userid A unique 16 character long hexadecimal string that represents a 64-bit integer. It is unknown how this number is generated. 6966442DE2EED063

In the request body there will be a file named spr-meta and a file per registered StreetPass game spr-slotXX where XX is an incrementing number. If the game contains not messages in its outbox so the size of the file would be 0 then no file is created and sent but it will still be listed in the spr-meta file.

spr-meta file[edit]

The spr-meta file is a text file which may contain the following content. 

slotsize: 5
spr-slot01: 3,000EC400,10664
spr-slot02: 2,0007AD00,3648
spr-slot03: 3,00030000,3804
spr-slot04: 1,00051600,0
spr-slot05: 0,00020800,28228

The comma seperated list after each spr-slotXX has the following meaning

Send Mode StreetPass ID (Low title ID of the game. May be from a different region like japan.) Size of the file in bytes

spr-slotXX files[edit]

These are binary files. They begin a with a header with the follwing structure.

Offset Size Description
0x00 0x04 Magic number 0x00006161
0x04 0x04 Size of the file in bytes including this header
0x08 0x04 StreetPass ID (Low title ID of the game. May be from a different region like japan.)
0x0C 0x04 Unknown
0x10 0x04 Number of messages after this header

After the header follows the StreetPass message exactly as it is stored in the outbox of CEC Save.

Response[edit]

The following headers are expected:

Key Value Example
X-Spr-SlotXX-Result StreetPass ID Send Mode Size of the file in bytes X-Spr-Slot01-Result: 000EC400,3,17760

It expects a header for every game it sent in the request.

The body is expected to contain binary data with the same structure as the spr-slotXX files in the request. The order of these must be the same as the reponse header order.

Structs, Data Types[edit]

Streetpass uses multiple different structs and data types for storing and transporting data.

MessageId[edit]

This datatype holds a per-console-per-title unique message id.

Type Description
u8[8] The message id

Timestamp12[edit]

This holds a timestamp in 12 bytes

Offset Size Type Name
0x0 0x4 u32 Year
0x4 0x1 u8 Month
0x5 0x1 u8 Day
0x6 0x1 u8 Weekday
0x7 0x1 u8 Hour
0x8 0x1 u8 Minute
0x9 0x1 u8 Second
0xA 0x2 u16 Millisecond

Message (0x6060)[edit]

MessageHeader:

Offset Size Type Name Description
0x00 0x2 u16 magic Equals 0x6060 (``)
0x02 0x2 u16 Padding
0x04 0x04 u32 message_size The size in bytes of the entire message, including all headers and hmac
0x08 0x04 u32 total_header_size The size in bytes of all headers, including the extra headers
0x0C 0x04 u32 body_size The size in bytes of the body of the message
0x10 0x04 u32 title_id The title id of the message
0x14 0x04 u32 title_id2 ???
0x18 0x04 u32 batch_id The sending client sets an ID here if multiple messages should be batched together into one transaction
0x1C 0x04 u32 transfer_id ???
0x20 0x08 MessageId message_id The ID of the sending message
0x28 0x04 u32 message_version ???
0x2C 0x08 MessageId message_id_2 The message ID that this message is referring to, e.g. the individual responses in Streetpass Mii Plaza
0x34 0x01 u8 flags ???
0x35 0x01 SendMethod send_method
0x36 0x01 bool unopened Set if the message hasn't been opened yet
0x37 0x01 bool is_new Set if the message is new
0x38 0x08 u64 sender_id
0x40 0x08 u64 sender_id_2
0x48 0x0C Timestamp12 sent
0x54 0x0C Timestamp12 received
0x60 0x0C Timestamp12 created
0x6C 0x01 u8 send_count How often this message can be sent
0x6D 0x01 u8 forward_count How often this message can be forwarded
0x6E 0x02 u16 user_data ???

ExtMessageHeader:

Offset Size Type Name Description
0x00 0x04 u32 type The type of the extra header
0x04 0x04 u32 size Size, in bytes, of the extra header
0x08 body The body of the extra header

Message:

Offset Size Type Name Description
0x00 0x70 MessageHeader header The header of the message
0x70 ExtMessageHeader[] ext_headers An array of the extra headers for the message. The array keeps filling until the length no more until header.total_header_size
body The actual body/payload of the message
0x20 u8[0x20] hmac The hmac over the body with the hmac_key

Slot (0x6161)[edit]

The slot groups multiple messages of one title id together into a single struct

Offset Size Type Name Description
0x00 0x02 u16 magic Equals 0x6161 (aa)
0x02 0x02 u16 padding
0x04 0x04 u32 size The size of bytes of the entire slot, including the header and all messages it contains
0x08 0x04 u32 title_id The title id of the slot
0x0C 0x04 u32 batch_id If the slot contains batched messages, the batch id is set to the same one as those messages
0x10 0x04 u32 message_count The total number of messages in this slot
0x14 Message[] messages An array of length message_count all the messages of this slot

BoxInfo (0x6262)[edit]

Offset Size Type Name Description
0x00 0x02 u16 magic Equals 0x6262 (bb)
0x02 0x02 u16 padding
0x04 0x04 u32 file_size The size of the box info in bytes
0x08 0x04 u32 max_box_size The maximum allowed size of the box in bytes
0x0C 0x04 u32 box_size The current size of the box in bytes
0x10 0x04 u32 max_num_messages The maximum number of messages that the box can hold
0x14 0x04 u32 num_messages The current number of messages in the box
0x18 0x04 u32 max_batch_size The maximum size of a bach, in number of messages
0x1C 0x04 u32 max_message_size The maximum size of a message, in bytes
0x20 MessageHeader[] message_headers An array of all message headers in this box of length num_messages

MBoxInfo (0x6363)[edit]

This holds information on the message box, including both inbox and outbox

Offset Size Type Name Description
0x00 0x02 u16 magic Equals 0x6363 (cc)
0x02 0x02 u16 padding
0x04 0x04 u32 title_id The title id for this mbox
0x08 0x04 u32 private_id ???
0x0C 0x01 u8 mbox_type_flags 0x01: normal programs, 0x06: system programs, 0x80: silent notif
0x0D 0x01 bool enabled Weather this message box is enabled
0x0E 0x02 u16 padding
0x10 0x20 u8[0x20] hmac_key The hmac key to make hmacs for messages. These are unique per title, however they are the same for all consoles.
0x30 0x04 u32 padding
0x34 0x0C Timestamp12 last_accessed
0x40 0x01 bool flag_unread Does this message box contain unread messages?
0x41 0x01 bool flag_new Does this message box contain new messages?
0x42 0x01 bool flag_unknown ???
0x43 0x01 bool flag_unknown ???
0x44 0x0C Timestamp12 last_received
0x50 0x04 u32 padding
0x54 0x0C Timestamp12 unknown_timestamp ???

0x6565[edit]

SlotMetadata:

Offset Size Type Name Description
0x00 0x04 u32 title_id The title id of the slot
0x04 0x04 SendMethod send_method The send method for the slot
0x08 0x04 u32 body_size The size of the slot body in bytes
0x0C 0x04 u32 count Number of messages
0x10 0x14 unknown unknown

Struct:

Offset Length Type Name Description
0x00 0x02 u16 magic Equals 0x6565 (ee)
0x02 0x02 u16 padding
0x04 0x28 unknown unknown
0x2C 0x360 SlotMetadata[0x18] slots Metadata of all slots

OBIndex (0x6767)[edit]

Offset Size Type Name Description
0x00 0x02 u16 magic Equals 0x6767 (gg)
0x02 0x02 u16 padding
0x04 0x04 u32 num_messages The number of messages in the outbox
0x08 MessageId[] message_ids An array of the message IDs in the outbox, of length num_messages

MBoxList (0x6868)[edit]

Offset Size Type Name Description
0x00 0x02 u16 magic Equals 0x6868 (hh)
0x02 0x02 u16 padding
0x04 0x04 u32 version
0x08 0x04 u32 num_boxes The number of boxes (= games with streetpass enabled)
0x0C 0x180 char[0x18][0x10] box_names A 0x18-long array of all the box names (= hex encoded title ids) of games with streetpass enabled
Retrieved from "https://www.3dbrew.org/w/index.php?title=StreetPass&oldid=22811"