Would it be possible to use a Nintendo DS's Download Play feature over the Internet? I don't have a ton of understanding of how the protocol works, but so far I'm pretty sure it uses a network of hidden WiFi networks to wirelessly connect to each other.

My plan is to use devices like a couple of ESP32s or Raspberry Pis to essentially forward these WiFi packets over the Internet, so two (physical) DSes could use Download Play remotely.

Latency aside, would this be possible? Does anybody have more information about how Download Play works under the hood, or maybe some open-source project that allows me to do this?


1 Answer 1


Michael Noland reverse-engineered the Wireless MultiBoot transport protocol in 2005. The original paper, Inferring a Proprietary Wireless L3 Protocol From Packet Traces, has probably been lost (along with the associated software), but the Internet Archive has preserved an excerpt from the paper and the slides from the associated presentation. You should really read the whole thing, but I've included the parts that seem the most relevant.

WMB uses beacon frames to advertise available games for download. The beacon frames are normally used to advertise available access points in most 802.11 systems, but there is nothing preventing their use in this capacity. The advertisement data is fragmented and stored partially in each beacon frame as the payload of a custom information element (tag: 0xDD).

The DS Download Play menu only lists games when the beacons are broadcasted on one of the following channels: 1, 3, 4, 5, 7, 9, 10, 11, 13, and 14. However, the DS hosting mechanism only seems to transmit on channels 1, 7, and 13 (apparently selected at random).

All beacon frames transmitted by a DS host have the following format:

802.11 management frame
802.11 beacon header
Supported rates (tagged IE, advertises 1 Mbit and 2 Mbit)
DS parameter set (tagged IE, note: Distribution System, not Nintendo DS)
TIM vector (tagged IE, transmitted as empty)
Custom extension (tagged IE, tag 0xDD)

The WMB protocol ostensibly implements layers 3 to 7 of the OSI network model, but does not define a new type of network addresses. However, it does define a couple of special broadcast-like MAC addresses within the assigned Nintendo namespace (00:09:BF).

The host does something unusual with the 802.11 sequence control field, each packet sent out on the 00 flow has a sequence control number 2 greater than the previous one, even if they are sent sequentially. When the host acknowledges a reply (on flow 03) from the client about a particular packet, it uses the sequence number one after the original packet number it sent out on 00. This is the root of one of the major problems in finding a PC card that can transmit WMB packets, as very few cards provide user control over it. Even when a card is capable of ‘raw’ 802.11 transmission, it typically takes care of the sequence control field in hardware or firmware, filling it with a constantly incrementing number.

// The checksum is computed over halfwords for the last 4 bytes
// of the ninty beacon header, plus the payload
// This func takes length in halfwords
uint16 computeBeaconChecksum(uint16 * data, int length) {
  uint32 sum = 0;
  for (int j = 0; j < length; j++) sum += *data++;
  sum = (-((sum >> 16) + (sum & 0xFFFF) + 1)) & 0xFFFF;
  return sum;
  • Analyzed some captures of PictoChat traffic to determine similarities
  • Each room has a fixed 802.11 channel:
    • Room A – Channel 1
    • Room B – Channel 7
    • Room C – Channel 13
    • Room D – Channel 7 again
  • Room beacon work similarly, using an extension 0xDD tag to transmit information like the current room capacity

As a first approximation, I would recommend listening on a particular channel (perhaps channel 1?) and relaying exactly the packets you receive with Nintendo MAC addresses: that should be enough for partial functionality for most games. From there, you should be able to figure out how to identify which channels should be in use – perhaps by replicating the channel scanning algorithm, which isn't documented afaik, or else by faking broadcasts and handling the beginning of the handshake yourself.

See also

Per pineight.com Nintendo DS passthrough methods, there was a Windows XP application by FireFly that implements the Wireless Multiboot protocol. If you can track this down, and find source code, you might be able to use it as a reference.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .