Nintendo DS development


This page is quite outdated now, the basic overview is that I am able to connect to the DS intermittently, but the connection is lost after a few hundred packets (this is unforunately very quick, the DS sends a lot of packets). So I am not to the point where I'm sending over a binary yet. However I've figured out the protocol I believe, so it appears to just be a matter of getting the timing under control. This may involve porting substantial parts of the connection software into the driver to get better response times, which is somewhat unfortunate.

- An atheros chipset based wireless card, I'm using the linksys WMP55AG.
- Linux 2.6+.

Current source (61k) - (includes drivers, multiboot beacons, and a readme this time :).

Old news

Basic overview: I have modified the driver for the Atheros chipset on the Linux platform, and have managed to fool the DS into believing that it is talking to another DS for about 2 seconds. After that there appears to be some handshaking happening that we do not yet understand. This is thanks to the efforts of numerous people as well, such as Darkain and crazyc, without whom we'd still be in the stone ages :).

We are now able to handshake with the DS, soon we will be sending the multiboot image over :).

Update #2: Thanks to crazyc from the gbadev forums, we can now modify the broadcast packets text to make the DS think a different game is available. The poorly named crccalc.c will replay the mario beacons.

Update: managed to get the DS to think Mario 64 is available for wireless download - can't send it yet, and can't modify the replayed packets because there appears to be some sort of CRC check. Try out replay.c on a libpcap capture of mario 64 sending out beacon frames, you'll need at least 4-5 seconds of capture.

Very good news, I put my DS into Pictochat and managed to get to start the 802.11b authentication process. This means it will at least be possible to research communication with the DS (multiboot, tunnelling). The source to the neccesary programs is here. BE WARNED, this is highly developmental software, it's quite possible it will crash your kernel, etc. Secondly, there is really no functionality here, it's a proof of concept, I'm releasing the source to help spur the development onwards.

The DS seeing my broadcast :)

Mirrors: - Graciously provided by GreenG of #dsdev.

Old source

modded madwifi - usual instructions for installing this, "make && make install". However! It is missing the hal/linux directory, you need to copy that over from the original madwifi source.
tools to test comms with ds - probably need to recompile dssniff.c, just gcc dssniff.c will do it.
Packet capture replayer - Replay captured packet streams. "gcc -lpcap replay.c" to compile.
Mario beacons - File is stored as follows: 4 byte integer denoting size of packet, then that many bytes, then next packet, etc...
CRC calculation - Compile using "gcc crccalc.c"
DS Multibooter - Compile using "gcc dsmultiboot.c", needs file "simplemariobeacons", just rename mariobeacons from above.
802.11 header format - Header file needed to compile most C files here. From Airjack source.

Links to other DS sites

Darkain's DS Site - The guy who started the WIFI work! Great resource. - The sister site of

Pictochat decoding

I made some new dumps of pictochat sending messages, the dumps are in the airopeek txt format. I'm posting the entire dump because there might still be some packets that my program misses (there were before, but I think I've finally got them all). I'm pretty sure the messages have been mostly decoded at this point, there are no remaining graphical issues, even with multi-line packets. Yay :).
Source (77k).

New dumps:
These images have a 2 pixel black border because otherwise they are difficult to pick out.

allfull - All 5 lines filled in.
full2 - The top line, completely full, no missing pixels.
2lines - 2 lines sent, random circular scribbles.
2lines - 2 horizontal lines sent, one full width on top, one full width second line.

Back to Main

Back to Main.


E-mail me at