NWM Services

These NWM services are used for local-WLAN communications, NWM module handles regular wifi APs as well. These services are used for creating/connecting to networks, and for sending/receiving data over the network etc. NWM module uses the wifi SDIO hardware via the IO registers for this.

Local-WLAN WPA2 Passphrase Generation

All local-WLAN communications have the WPA2 passphrase generated the same way with NWM module. The input data used with EncryptDecryptAes with keytype1 is a MD5 hash over an input passphrase. This input passphrase is fixed for Download Play(the input passphrase for StreetPass is unknown), it's unique per local-WLAN protocol. The CTR is a MD5 hash over the below 0x10-byte structure. The output from encrypting that data with AES-CTR is the final WPA2 passphrase.

Structure used for generating the CTR

Offset	Size	Description
0x0	0x4	Little-endian local-WLAN communication ID, normally this is the user process' UniqueID from the titleID. For Download Play, this is always 0x2810 on retail.
0x4	0x4	Little-endian u32 networkID, randomly-generated when creating the network. The network SSID used when a client connects to the network is sprintf(out, "%08X", networkID).
0x8	0x6	Host MAC address.
0xE	0x2	Little-endian ID, for Download Play this is 0x55.