DSi Wifi rev-engineering

                 arm9_create_thread    equ 0205D478h+1  ;struct,proc,0,stack,C8h,1Fh
                 arm9_sleep_thread     equ 0205D6B0h+1  ;zero

arm9_file_open        equ 02056F64h  ;handle,filename,mode?
arm9_file_close       equ 02056FB0h  ;handle
arm9_file_read        equ 02057054h  ;handle,dst,len
arm9_file_write       equ 02057088h  ;handle,src,len
arm9_get_filesize     equ 02056FD4h  ;handle
arm9_file_seek        equ 0205703Ch  ;handle,offset,00h
arm9_file_create      equ 02056BD0h  ;filename,03h
arm9_file_delete      equ 02056C10h  ;filename
arm9_create_thread    equ 0205D478h  ;struct,proc,param_for_proc,stack,stacksize(C8h)?,type/prio(03h/1Fh)?
arm9_enable_thread    equ 0205D72Ch  ;struct
arm9_sleep_millisecs  equ 0205D84Ch  ;milliseconds

No$2000 SDIO log (done without paying $2000 for a SD/SDIO hardware logging tool)

Cmd  Param    Reply    NumBlk x BlkLen Data bytes
----------------------------------------------------------
Delay 01D8
0434 04000900 00001000
0434 04000100 00001011
0434 04001300 00001000
0434 04001500 00001010
0434 04001700 00001000
0434 04200100 00001001
0434 04200300 00001003
0434 04200B00 00001020
0434 04200D00 00001004
0434 04200F00 00001071
0434 04201100 00001002
0434 04201300 00001000
0434 04201500 00001002
0434 04002500 00001003
0434 84002502 00001002
0434 04001100 00001017
0434 04200100 00001001
0434 04200300 00001003
0434 04200B00 00001020
0434 04200D00 00001004
0434 04201700 00001021
0434 04201900 00001002
0434 04201F00 00001022
0434 04202100 00001004
0434 04202300 00001000
0434 04202500 00001000
0434 04202700 00001008
0434 04202900 00001032
0434 84000F82 00001082
0434 84001117 00001017
0434 04020100 00001000
0434 04021300 00001000
0434 04021500 00001011
0434 04021700 00001000
0434 04220100 00001020
0434 04220300 00001004
0434 04220D00 00001021
0434 04220F00 00001002
0434 04221500 00001022
0434 04221700 0000102A
0434 04221900 00001001
0434 04221B00 00001001
0434 04221D00 00001011
0434 04221F00 00001000
0434 04222100 00001000
0434 04222300 00001000
0434 04222500 00001000
0434 04222700 00001000
0434 04222900 00001000
0434 04222B00 00001000
0434 04222D00 00001000
0434 04222F00 00001000
0434 04223100 00001000
0434 04223300 00001008
0434 04223500 00001000
0434 04223700 00001000
0434 04223900 000010FF
0434 04223B00 00001080
0434 04223D00 00001000
0434 04223F00 00001000
0434 04224100 00001000
0434 04224300 00001000
0434 04224500 00001001
0434 04224700 0000100A
0434 04224900 00001000
0434 04224B00 00001000
0434 04224D00 00001000
0434 04224F00 00001000
0434 04225100 00001000
0434 04225300 00001000
0434 04225500 00001000
0434 04225700 00001000
0434 04225900 00001000
0434 04225B00 00001000
0434 04225D00 00001000
0434 04225F00 00001001
0434 04226100 00001000
0434 04226300 00001001
0434 04226500 00001000
0434 04226700 00001001
0434 04226900 00001000
0434 04226B00 00001001
0434 04220100 00001020
0434 04220300 00001004
0434 04220500 00001071
0434 04220700 00001002
0434 04220900 00001000
0434 04220B00 00001002
0434 84022180 00001080
0434 84022300 00001000
0434 04220100 00001020
0434 04220300 00001004
0434 04220D00 00001021
0434 04220F00 00001002
0434 04221500 00001022
0434 04221700 0000102A
0434 04221900 00001001
0434 04221B00 00001001
0434 04221D00 00001011
0434 04221F00 00001000
0434 04222100 00001000
0434 04222300 00001000
0434 04222500 00001000
0434 04222700 00001000
0434 04222900 00001000
0434 04222B00 00001000
0434 04222D00 00001000
0434 04222F00 00001000
0434 04223100 00001000
0434 04223300 00001008
0434 04223500 00001000
0434 04223700 00001000
0434 04223900 000010FF
0434 04223B00 00001080
0434 04223D00 00001000
0434 04223F00 00001000
0434 04224100 00001000
0434 04224300 00001000
0434 04224500 00001001
0434 04224700 0000100A
0434 04224900 00001000
0434 04224B00 00001000
0434 04224D00 00001000
0434 04224F00 00001000
0434 04225100 00001000
0434 04225300 00001000
0434 04225500 00001000
0434 04225700 00001000
0434 04225900 00001000
0434 04225B00 00001000
0434 04225D00 00001000
0434 04225F00 00001001
0434 04226100 00001000
0434 04226300 00001001
0434 04226500 00001000
0434 04226700 00001001
0434 04226900 00001000
0434 04226B00 00001001
0434 04000500 00001002
0434 84000502 00001002
0434 04000700 00001002
4C35 94083004 00001000 0001x0004 00 00 00 00
4C35 9408FA03 00001000 0001x0003 40 00 00
4C35 9408F801 00001000 0001x0001 EC
5C35 1408E804 00001000 0001x0004 20 00 00 00
4C35 9408FA03 00001000 0001x0003 04 50 00
4C35 9408F801 00001000 0001x0001 58
5C35 1408E804 00001000 0001x0004 00 00 00 00
5C35 1408A004 00001000 0001x0004 00 00 00 00
4C35 941FF804 00001000 0001x0004 08 00 00 00
5C35 141FF804 00001000 0001x0004 00 00 00 00
5C35 141FF804 00001000 0001x0004 F7 47 7C 03
5C35 141FF008 00001000 0001x0008 FF FF FF FF 94 B0 FD 02
5C35 1408A004 00001000 0001x0004 00 00 00 00
4C35 941FE010 00001000 0001x0010 03 00 00 00 00 04 50 00 04 00 00 00 02 00 00 00
5C35 1408A004 00001000 0001x0004 00 00 00 00
4C35 941FF008 00001000 0001x0008 06 00 00 00 C0 80 01 00
5C35 141FF804 00001000 0001x0004 06 00 00 00
5C35 1408A004 00001000 0001x0004 00 00 00 00
4C35 941FE80C 00001000 0001x000C 07 00 00 00 C0 80 01 00 08 00 00 00
5C35 1408A004 00001000 0001x0004 00 00 00 00
4C35 941FF008 00001000 0001x0008 06 00 00 00 C4 40 00 00
5C35 141FF804 00001000 0001x0004 06 00 00 00
5C35 1408A004 00001000 0001x0004 00 00 00 00
4C35 941FE80C 00001000 0001x000C 07 00 00 00 C4 40 00 00 09 00 00 00
5C35 1408A004 00001000 0001x0004 00 00 00 00
4C35 941FE80C 00001000 0001x000C 07 00 00 00 28 40 00 00 05 00 00 00
5C35 1408A004 00001000 0001x0004 00 00 00 00
4C35 941FE80C 00001000 0001x000C 07 00 00 00 20 40 00 00 00 00 00 00
Delay 0072
4C35 94083004 00001000 0001x0004 00 00 00 00
5C35 14080010 00001000 0001x0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4C35 94080004 00001000 0001x0004 00 00 00 00
5C35 14080010 00001000 0001x0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0434 84000900 00001000

No$2000 SDIO log (done without paying $2000 for a SD/SDIO hardware logging tool)
Delay 01D7
Read  Func[0:00004] = 00
Read  Func[0:00000] = 11
Read  Func[0:00009] = 00
...(snip)...
Read  Func[0:01135] = 01
Read  Func[0:00002] = 02
Write Func[0:00002] = 02
Read  Func[0:00003] = 02
Write Func[1:00418] = Len:0001x0004 00 00 00 00
Read  Mem[000040EC] = 02000001
Read  Mem[00500458] = 00000000
Read  Func[1:00450] = Len:0001x0004 01 00 00 00
Write Func[1:00FFC] = Len:0001x0004 08 00 00 00
Read  Func[1:00FFC] = Len:0001x0004 FF FF FF FF
Read  Func[1:00FFC] = Len:0001x0004 0C 00 00 00
Read  Func[1:00FF8] = Len:0001x0008 88 01 00 20 02 00 00 00
Read  Func[1:00450] = Len:0001x0004 01 00 00 00
Write Func[1:00FF0] = Len:0001x0010 03 00 00 00 00 04 50 00 04 00 00 00 02 00 00 00
Read  Func[1:00450] = Len:0001x0004 01 00 00 00
Write Func[1:00FF8] = Len:0001x0008 06 00 00 00 C0 80 01 00
Read  Func[1:00FFC] = Len:0001x0004 00 00 00 00
Read  Func[1:00450] = Len:0001x0004 01 00 00 00
Write Func[1:00FF4] = Len:0001x000C 07 00 00 00 C0 80 01 00 08 00 00 00
Read  Func[1:00450] = Len:0001x0004 01 00 00 00
Write Func[1:00FF8] = Len:0001x0008 06 00 00 00 C4 40 00 00
Read  Func[1:00FFC] = Len:0001x0004 08 00 00 00
Read  Func[1:00450] = Len:0001x0004 01 00 00 00
Write Func[1:00FF4] = Len:0001x000C 07 00 00 00 C4 40 00 00 09 00 00 00
Read  Func[1:00450] = Len:0001x0004 01 00 00 00
Write Func[1:00FF4] = Len:0001x000C 07 00 00 00 28 40 00 00 05 00 00 00
Read  Func[1:00450] = Len:0001x0004 01 00 00 00
Write Func[1:00FF4] = Len:0001x000C 07 00 00 00 20 40 00 00 00 00 00 00
Delay 0072
Write Func[1:00418] = Len:0001x0004 00 00 00 00
Read  Func[1:00400] = Len:0001x0010 00 00 00 00 0F 00 0F 00 00 00 00 00 00 00 00 00
Write Func[1:00400] = Len:0001x0004 00 00 00 00
Read  Func[1:00400] = Len:0001x0010 00 00 00 00 0F 00 0F 00 00 00 00 00 00 00 00 00
Write Func[0:00004] = 00

No$2000 SDIO log (done without paying $2000 for a SD/SDIO hardware logging tool)
 Showing WRITES (after leading BMI commands) from DSi browser with AR6013G chip
 aa aa aa aa aa aa = Access Point
 bb bb bb bb bb bb = Router
 mm mm mm mm mm mm = DSi Console
 "ead"               SSID
 "dslink-dslink"     WEP password
Write Func[1:00F80] = Len:0001x0080 00 00 08 00 00 00 0002   (unknown init?)                    00 01 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 00 00 08 00 00 00 0002   (unknown init?)                    01 01 05 00 00 00
Write Func[1:00F80] = Len:0001x0080 00 00 08 00 00 00 0002   (unknown init?)                    02 01 05 00 00 00
Write Func[1:00F80] = Len:0001x0080 00 00 08 00 00 00 0002   (unknown init?)                    03 01 05 00 00 00
Write Func[1:00F80] = Len:0001x0080 00 00 08 00 00 00 0002   (unknown init?)                    04 01 05 00 00 00
Write Func[1:00F80] = Len:0001x0080 00 00 02 00 00 00 0004   (unknown init??)                   -
Write Func[1:00418] = Len:0001x0004 D1 00 03 01
Write Func[0:00004] = 03
Write Mem[0052B2A0] = 00000002
Write Func[1:00F80] = Len:0001x0080 01 01 06 00 00 00 0022 WMI_TARGET_ERROR_REPORT_BITMASK_CMD  7F 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 06 00 00 00 0047 WMI_SET_FRAMERATES_CMD               02 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 06 00 00 00 0022 WMI_TARGET_ERROR_REPORT_BITMASK_CMD  7F 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 02 00 00 00 000E WMI_GET_CHANNEL_LIST_CMD             -
Write Func[1:00F80] = Len:0001x0080 01 01 25 00 00 00 000A WMI_SET_PROBED_SSID_CMD              00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 08 00 00 00 0011 WMI_SET_CHANNEL_PARAMS_CMD           00 00 02 01 6C 09
Write Func[1:00F80] = Len:0001x0080 01 01 16 00 00 00 0008 WMI_SET_SCAN_PARAMS_CMD              FF FF FF FF FF FF 6A 00 6A 00 00 01 6A 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 0A 00 00 00 0009 WMI_SET_BSS_FILTER_CMD               01 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 16 00 00 00 0007 WMI_START_SCAN_CMD                   00 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00
Delay 0003+0003
Write Func[1:00F80] = Len:0001x0080 01 01 0A 00 00 00 0009 WMI_SET_BSS_FILTER_CMD               00 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 25 00 00 00 000A WMI_SET_PROBED_SSID_CMD              00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 08 00 00 00 0011 WMI_SET_CHANNEL_PARAMS_CMD           00 00 02 01 6C 09
Write Func[1:00F80] = Len:0001x0080 01 01 16 00 00 00 0008 WMI_SET_SCAN_PARAMS_CMD              FF FF FF FF FF FF 6A 00 6A 00 00 01 6A 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 0A 00 00 00 0009 WMI_SET_BSS_FILTER_CMD               01 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 16 00 00 00 0007 WMI_START_SCAN_CMD                   00 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00
Delay 0004
Write Func[1:00F80] = Len:0001x0080 01 01 0A 00 00 00 0009 WMI_SET_BSS_FILTER_CMD               00 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 25 00 00 00 000A WMI_SET_PROBED_SSID_CMD              00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 08 00 00 00 0011 WMI_SET_CHANNEL_PARAMS_CMD           00 00 02 01 6C 09
Write Func[1:00F80] = Len:0001x0080 01 01 16 00 00 00 0008 WMI_SET_SCAN_PARAMS_CMD              FF FF FF FF FF FF 6A 00 6A 00 00 01 6A 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 0A 00 00 00 0009 WMI_SET_BSS_FILTER_CMD               01 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 16 00 00 00 0007 WMI_START_SCAN_CMD                   00 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00
Delay 0002+0002+0002
Write Func[1:00F80] = Len:0001x0080 01 01 0A 00 00 00 0009 WMI_SET_BSS_FILTER_CMD               00 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 25 00 00 00 000A WMI_SET_PROBED_SSID_CMD              00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 08 00 00 00 0011 WMI_SET_CHANNEL_PARAMS_CMD           00 00 02 01 76 09
Write Func[1:00F80] = Len:0001x0080 01 01 16 00 00 00 0008 WMI_SET_SCAN_PARAMS_CMD              FF FF FF FF FF FF 6B 00 6B 00 00 01 6B 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 0A 00 00 00 0009 WMI_SET_BSS_FILTER_CMD               01 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 16 00 00 00 0007 WMI_START_SCAN_CMD                   00 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00
Delay 0004
Write Func[1:00F80] = Len:0001x0080 01 01 0A 00 00 00 0009 WMI_SET_BSS_FILTER_CMD               00 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 25 00 00 00 000A WMI_SET_PROBED_SSID_CMD              00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 08 00 00 00 0011 WMI_SET_CHANNEL_PARAMS_CMD           00 00 02 01 76 09
Write Func[1:00F80] = Len:0001x0080 01 01 16 00 00 00 0008 WMI_SET_SCAN_PARAMS_CMD              FF FF FF FF FF FF 6B 00 6B 00 00 01 6B 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 0A 00 00 00 0009 WMI_SET_BSS_FILTER_CMD               01 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 16 00 00 00 0007 WMI_START_SCAN_CMD                   00 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00
Delay 0005
Write Func[1:00F80] = Len:0001x0080 01 01 0A 00 00 00 0009 WMI_SET_BSS_FILTER_CMD               00 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 25 00 00 00 000A WMI_SET_PROBED_SSID_CMD              00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 08 00 00 00 0011 WMI_SET_CHANNEL_PARAMS_CMD           00 00 02 01 80 09
Write Func[1:00F80] = Len:0001x0080 01 01 16 00 00 00 0008 WMI_SET_SCAN_PARAMS_CMD              FF FF FF FF FF FF 6F 00 6F 00 00 01 6F 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 0A 00 00 00 0009 WMI_SET_BSS_FILTER_CMD               01 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 16 00 00 00 0007 WMI_START_SCAN_CMD                   00 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00
Delay 0004+0002
Write Func[1:00F80] = Len:0001x0080 01 01 0A 00 00 00 0009 WMI_SET_BSS_FILTER_CMD               00 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 25 00 00 00 000A WMI_SET_PROBED_SSID_CMD              00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 08 00 00 00 0011 WMI_SET_CHANNEL_PARAMS_CMD           00 00 02 01 8A 09
Write Func[1:00F80] = Len:0001x0080 01 01 16 00 00 00 0008 WMI_SET_SCAN_PARAMS_CMD              FF FF FF FF FF FF 70 00 70 00 00 01 70 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 0A 00 00 00 0009 WMI_SET_BSS_FILTER_CMD               01 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 16 00 00 00 0007 WMI_START_SCAN_CMD                   00 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 0E 00 01 01 002E WMIX_HB_CHALLENGE_RESP_CMD           08 20 00 00 01 00 00 00 00 00 00 00
Delay 0003
Write Func[1:00F80] = Len:0001x0080 01 01 0A 00 00 00 0009 WMI_SET_BSS_FILTER_CMD               00 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 06 00 00 00 0022 WMI_TARGET_ERROR_REPORT_BITMASK_CMD  7F 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 0A 00 00 00 0009 WMI_SET_BSS_FILTER_CMD               00 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 25 00 00 00 000A WMI_SET_PROBED_SSID_CMD              00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 16 00 00 00 0008 WMI_SET_SCAN_PARAMS_CMD              FF FF FF FF FF FF C8 00 C8 00 00 05 C8 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 08 00 00 00 0011 WMI_SET_CHANNEL_PARAMS_CMD           00 00 02 01 85 09
Write Func[1:00F80] = Len:0001x0080 01 01 05 00 00 00 F000 WMI_SET_BITRATE_CMD                  FF 00 00
Write Func[1:00F80] = Len:0001x0080 01 01 06 00 00 00 0048 WMI_SET_AP_PS_CMD                    01 A4 F7 FF
Write Func[1:00F80] = Len:0001x0080 01 01 03 00 00 00 0004 WMI_SYNCHRONIZE_CMD                  00
Write Func[1:00F80] = Len:0001x0080 01 01 03 00 00 00 0012 WMI_SET_POWER_MODE_CMD               02
Write Func[1:00F80] = Len:0001x0080 01 01 03 00 00 00 0004 WMI_SYNCHRONIZE_CMD                  00
Write Func[1:00F80] = Len:0001x0080 01 01 41 00 00 00 0005 WMI_CREATE_PSTREAM_CMD               14 00 00 00 14 00 00 00 7F 96 98 00 FF FF FF FF 00 00 00 00 00 45 01 00 00 45 01 00 00 45 01 00 00 00 00 00 00 00 00 00 80 8D 5B 00 00 20 00 00 00 00 00 00 D0 80 D0 00 00 02 FF 01 00 05 00
Write Func[1:00F80] = Len:0001x0080 01 01 03 00 00 00 0041 WMI_SET_WSC_STATUS_CMD               00
Write Func[1:00F80] = Len:0001x0080 01 01 03 00 00 00 000D WMI_SET_DISCONNECT_TIMEOUT   (_CMD)  02
Write Func[1:00F80] = Len:0001x0080 01 01 2F 00 00 00 0016 WMI_ADD_CIPHER_KEY_CMD               00 02 03 0D 00 00 00 00 00 00 00 00 "dslink-dslink" 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03
Write Func[1:00F80] = Len:0001x0080 01 01 2F 00 08 20 0016 WMI_ADD_CIPHER_KEY_CMD               01 02 01 0D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03
Write Func[1:00F80] = Len:0001x0080 01 01 2F 00 00 00 0016 WMI_ADD_CIPHER_KEY_CMD               02 02 01 0D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03
Write Func[1:00F80] = Len:0001x0080 01 01 2F 00 00 00 0016 WMI_ADD_CIPHER_KEY_CMD               03 02 01 0D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03
Write Func[1:00F80] = Len:0001x0080 01 01 03 00 00 00 003D WMI_SET_KEEPALIVE_CMD                00
Write Func[1:00F80] = Len:0001x0080 01 01 36 00 00 00 0001 WMI_CONNECT_CMD                      01 02 01 02 00 02 00 03 "ead" 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 85 09 aa aa aa aa aa aa 00 00 00 00
Delay 0006+0007+001E+0006
Write Func[1:00F80] = Len:0001x0080 01 01 0E 00 01 01 002E WMIX_HB_CHALLENGE_RESP_CMD           08 20 00 00 02 00 00 00 00 00 00 00
Delay 0009+0002+000E
Write Func[1:00E80] = Len:0003x0080 02 00 60 01 00 00 0000   (data)                             FF FF FF FF FF FF mm mm mm mm mm mm 01 50 AA AA 03 00 00 00 08 00 45 00 01 48 00 01 00 00 80 11 39 A5 00 00 00 00 FF FF FF FF 00 44 00 43 01 34 CE 2E 01 01 06 00 5E 20 82 7D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 mm mm mm mm mm mm 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 63 82 53 63 35 01 01 3D 07 01 mm mm mm mm mm mm 0C 0A "NintendoDS" 37 03 01 03 06 FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Delay 0009
Write Func[1:00F80] = Len:0001x0080 01 01 41 00 00 00 0005 WMI_CREATE_PSTREAM_CMD               00 00 00 00 00 00 00 00 88 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 00 FF 06
Delay 0002+0003+0013
Write Func[1:00F80] = Len:0001x0080 01 01 0E 00 01 01 002E WMIX_HB_CHALLENGE_RESP_CMD           08 20 00 00 03 00 00 00 00 00 00 00
Delay 000C
Write Func[1:00E80] = Len:0003x0080 02 00 60 01 00 00 0000   (data)                             FF FF FF FF FF FF mm mm mm mm mm mm 01 50 AA AA 03 00 00 00 08 00 45 00 01 48 00 02 00 00 80 11 39 A4 00 00 00 00 FF FF FF FF 00 44 00 43 01 34 57 64 01 01 06 00 A6 CA 35 B2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 mm mm mm mm mm mm 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 63 82 53 63 35 01 03 3D 07 01 mm mm mm mm mm mm 0C 0A "NintendoDS" 37 03 01 03 06 32 04 C0 A8 01 1E 36 04 C0 A8 01 01 FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Delay 002E
Write Func[1:00F80] = Len:0001x0080 02 00 34 00 00 00 1C00   (special data?)                    FF FF FF FF FF FF mm mm mm mm mm mm 00 24 AA AA 03 00 00 00 08 06 00 01 08 00 06 04 00 01 mm mm mm mm mm mm C0 A8 01 1E 00 00 00 00 00 00 C0 A8 01 1E
Write Func[1:00F80] = Len:0001x0080 01 01 0E 00 01 01 002E WMIX_HB_CHALLENGE_RESP_CMD           08 20 00 00 04 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 02 00 34 00 00 00 1C00   (special data?)                    FF FF FF FF FF FF mm mm mm mm mm mm 00 24 AA AA 03 00 00 00 08 06 00 01 08 00 06 04 00 01 mm mm mm mm mm mm C0 A8 01 1E 00 00 00 00 00 00 C0 A8 01 01
Delay 0005
Write Func[1:00F80] = Len:0001x0080 02 00 34 00 00 00 1C00   (special data?)                    FF FF FF FF FF FF mm mm mm mm mm mm 00 24 AA AA 03 00 00 00 08 06 00 01 08 00 06 04 00 01 mm mm mm mm mm mm C0 A8 01 1E 00 00 00 00 00 00 C0 A8 01 1E
Write Func[1:00F80] = Len:0001x0080 02 01 5F 00 00 00 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 00 4F AA AA 03 00 00 00 08 00 45 00 00 47 00 03 00 00 80 11 B7 33 C0 A8 01 1E C0 A8 01 01 12 E6 00 35 00 33 C1 41 F7 83 01 00 00 01 00 00 00 00 00 00 08 "conntest" 0C "nintendowifi" 03 "net" 00 00 01 00 01
Write Func[1:00F80] = Len:0001x0080 02 00 48 00 00 00 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 00 38 AA AA 03 00 00 00 08 00 45 00 00 30 00 04 00 00 80 06 A8 58 C0 A8 01 1E 45 19 8B 8C 12 E7 00 50 47 B7 F9 BF 00 00 00 00 70 02 0B 68 91 01 00 00 02 04 05 50 01 01 04 02
Delay 0007+0003
Write Func[1:00F80] = Len:0001x0080 02 00 34 00 00 00 1C00   (special data?)                    bb bb bb bb bb bb mm mm mm mm mm mm 00 24 AA AA 03 00 00 00 08 06 00 01 08 00 06 04 00 02 mm mm mm mm mm mm C0 A8 01 1E bb bb bb bb bb bb C0 A8 01 01
Write Func[1:00F80] = Len:0001x0080 01 01 41 00 00 00 0005 WMI_CREATE_PSTREAM_CMD               00 00 00 00 00 00 00 00 88 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 FF 01
Write Func[1:00F80] = Len:0001x0080 02 00 40 00 00 00 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 00 30 AA AA 03 00 00 00 08 00 45 00 00 28 00 05 00 00 80 06 A8 5F C0 A8 01 1E 45 19 8B 8C 12 E7 00 50 47 B7 F9 C0 9E C7 66 EE 50 10 0B 68 B7 9B 00 00
Write Func[1:00F00] = Len:0002x0080 02 01 86 00 00 00 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 00 76 AA AA 03 00 00 00 08 00 45 00 00 6E 00 06 00 00 80 06 A8 18 C0 A8 01 1E 45 19 8B 8C 12 E7 00 50 47 B7 F9 C0 9E C7 66 EE 50 18 0B 68 59 55 00 00 GET / HTTP/1.0Host: conntest.nintendowifi.netConnection: close
Delay 000A
Write Func[1:00F80] = Len:0001x0080 02 00 40 00 00 00 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 00 30 AA AA 03 00 00 00 08 00 45 00 00 28 00 07 00 00 80 06 A8 5D C0 A8 01 1E 45 19 8B 8C 12 E7 00 50 47 B7 FA 06 9E C7 68 62 50 11 09 F5 B7 53 00 00
Write Func[1:00F80] = Len:0001x0080 02 01 40 00 08 20 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 00 30 AA AA 03 00 00 00 08 00 45 00 00 28 00 08 00 00 80 06 A8 5C C0 A8 01 1E 45 19 8B 8C 12 E7 00 50 47 B7 FA 06 9E C7 68 62 50 10 0B 68 B5 E1 00 00
Delay 000A
Write Func[1:00F80] = Len:0001x0080 02 00 40 00 00 00 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 00 30 AA AA 03 00 00 00 08 00 45 00 00 28 00 09 00 00 80 06 A8 5B C0 A8 01 1E 45 19 8B 8C 12 E7 00 50 47 B7 FA 07 00 00 00 00 50 04 00 00 C8 7E 00 00
Delay 0012
Write Func[1:00F80] = Len:0001x0080 01 01 0E 00 01 01 002E WMIX_HB_CHALLENGE_RESP_CMD           08 20 00 00 05 00 00 00 00 00 00 00
Delay 003B
Write Func[1:00F80] = Len:0001x0080 01 01 0E 00 01 01 002E WMIX_HB_CHALLENGE_RESP_CMD           08 20 00 00 06 00 00 00 00 00 00 00
Delay 003B
Write Func[1:00F80] = Len:0001x0080 02 00 34 00 00 00 1C00   (special data?)                    FF FF FF FF FF FF mm mm mm mm mm mm 00 24 AA AA 03 00 00 00 08 06 00 01 08 00 06 04 00 01 mm mm mm mm mm mm C0 A8 01 1E 00 00 00 00 00 00 C0 A8 01 01
Write Func[1:00F80] = Len:0001x0080 01 01 0E 00 01 01 002E WMIX_HB_CHALLENGE_RESP_CMD           08 20 00 00 07 00 00 00 00 00 00 00
Delay 000F+0021+000C
Write Func[1:00F80] = Len:0001x0080 01 01 0E 00 02 00 002E WMIX_HB_CHALLENGE_RESP_CMD           08 20 00 00 08 00 00 00 00 00 00 00
Delay 0026+0004+0010
Write Func[1:00F80] = Len:0001x0080 01 01 0E 00 01 01 002E WMIX_HB_CHALLENGE_RESP_CMD           08 20 00 00 09 00 00 00 00 00 00 00
Delay 000C+0005+002A
Write Func[1:00F80] = Len:0001x0080 01 01 0E 00 02 00 002E WMIX_HB_CHALLENGE_RESP_CMD           08 20 00 00 0A 00 00 00 00 00 00 00
Delay 003C
Write Func[1:00F80] = Len:0001x0080 01 01 0E 00 02 00 002E WMIX_HB_CHALLENGE_RESP_CMD           08 20 00 00 0B 00 00 00 00 00 00 00
Delay 0029+0013
Write Func[1:00F80] = Len:0001x0080 01 01 0E 00 02 01 002E WMIX_HB_CHALLENGE_RESP_CMD           08 20 00 00 0C 00 00 00 00 00 00 00
Delay 0020+001C
Write Func[1:00F80] = Len:0001x0080 01 01 0E 00 02 00 002E WMIX_HB_CHALLENGE_RESP_CMD           08 20 00 00 0D 00 00 00 00 00 00 00
Delay 003B
Write Func[1:00F80] = Len:0001x0080 01 01 0E 00 02 00 002E WMIX_HB_CHALLENGE_RESP_CMD           08 20 00 00 0E 00 00 00 00 00 00 00
Delay 003B
Write Func[1:00F80] = Len:0001x0080 01 01 0E 00 01 01 002E WMIX_HB_CHALLENGE_RESP_CMD           08 20 00 00 0F 00 00 00 00 00 00 00
Delay 0020+001B
Write Func[1:00F80] = Len:0001x0080 01 01 0E 00 02 00 002E WMIX_HB_CHALLENGE_RESP_CMD           08 20 00 00 10 00 00 00 00 00 00 00
Delay 003C
Write Func[1:00F80] = Len:0001x0080 01 01 0E 00 02 00 002E WMIX_HB_CHALLENGE_RESP_CMD           08 20 00 00 11 00 00 00 00 00 00 00
Delay 0005+0007+0024
Write Func[1:00F80] = Len:0001x0080 01 01 41 00 08 20 0005 WMI_CREATE_PSTREAM_CMD               00 00 00 00 00 00 00 00 88 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 00 FF 06
Delay 0006+0005
Write Func[1:00F80] = Len:0001x0080 01 01 0E 00 02 00 002E WMIX_HB_CHALLENGE_RESP_CMD           08 20 00 00 12 00 00 00 00 00 00 00
Delay 000A+0030
Write Func[1:00F80] = Len:0001x0080 01 01 0E 00 01 01 002E WMIX_HB_CHALLENGE_RESP_CMD           08 20 00 00 13 00 00 00 00 00 00 00
Delay 000A+0003+000C+0023
Write Func[1:00F80] = Len:0001x0080 01 01 0E 00 01 01 002E WMIX_HB_CHALLENGE_RESP_CMD           08 20 00 00 14 00 00 00 00 00 00 00
Delay 000D+000A+001B+000A
Write Func[1:00F80] = Len:0001x0080 01 01 0E 00 02 00 002E WMIX_HB_CHALLENGE_RESP_CMD           08 20 00 00 15 00 00 00 00 00 00 00
Delay 000C+000A+0014+0011
Write Func[1:00F80] = Len:0001x0080 01 01 0E 00 01 01 002E WMIX_HB_CHALLENGE_RESP_CMD           08 20 00 00 16 00 00 00 00 00 00 00
Delay 000D+0009+0014+0004+000D
Write Func[1:00F80] = Len:0001x0080 01 01 0E 00 02 00 002E WMIX_HB_CHALLENGE_RESP_CMD           08 20 00 00 17 00 00 00 00 00 00 00
Delay 000D+0004+0005+0015+000D
Write Func[1:00F80] = Len:0001x0080 02 00 56 00 08 20 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 00 46 AA AA 03 00 00 00 08 00 45 00 00 3E 00 0A 00 00 80 11 B7 35 C0 A8 01 1E C0 A8 01 01 12 E8 00 35 00 2A 68 A0 00 01 01 00 00 01 00 00 00 00 00 00 0D "problemkaputt" 02 "de" 00 00 01 00 01
Write Func[1:00F80] = Len:0001x0080 02 00 48 00 08 20 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 00 38 AA AA 03 00 00 00 08 00 45 00 00 30 00 0B 00 00 80 06 DE 62 C0 A8 01 1E 58 C6 41 CE 12 E9 00 50 1A 83 7B 74 00 00 00 00 70 02 80 00 FD F7 00 00 02 04 05 50 01 01 04 02
Write Func[1:00F80] = Len:0001x0080 02 00 40 00 08 20 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 00 30 AA AA 03 00 00 00 08 00 45 00 00 28 00 0C 00 00 80 06 DE 69 C0 A8 01 1E 58 C6 41 CE 12 E9 00 50 1A 83 7B 75 21 7A 6C 94 50 10 80 00 9C 39 00 00
Write Func[1:00E00] = Len:0004x0080 02 01 BF 01 00 00 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 01 AF AA AA 03 00 00 00 08 00 45 00 01 A7 00 0D 00 00 80 06 DC E9 C0 A8 01 1E 58 C6 41 CE 12 E9 00 50 1A 83 7B 75 21 7A 6C 94 50 18 80 00 A8 12 00 00 GET / HTTP/1.1User-Agent: Opera/9.50 (Nintendo DSi; Opera/507; U; en-GB)Host: problemkaputt.deAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: enAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0Connection: Keep-Alive
Write Func[1:00F80] = Len:0001x0080 01 01 0E 00 02 01 002E WMIX_HB_CHALLENGE_RESP_CMD           08 20 00 00 18 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 02 00 40 00 08 20 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 00 30 AA AA 03 00 00 00 08 00 45 00 00 28 00 0E 00 00 80 06 DE 67 C0 A8 01 1E 58 C6 41 CE 12 E9 00 50 1A 83 7C F4 21 7A 72 54 50 10 7A 40 9A BA 00 00
Delay 000C+0008
Write Func[1:00D80] = Len:0005x0080 02 00 20 02 00 00 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 02 10 AA AA 03 00 00 00 08 00 45 00 02 08 00 0F 00 00 80 06 DC 86 C0 A8 01 1E 58 C6 41 CE 12 E9 00 50 1A 83 7C F4 21 7A 72 54 50 18 7A 40 04 7A 00 00 GET /char-f.gif HTTP/1.1User-Agent: Opera/9.50 (Nintendo DSi; Opera/507; U; en-GB)Host: problemkaputt.deAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: enAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0Referer: http://problemkaputt.de/Connection: Keep-Alive, TETE: deflate, gzip, chunked, identity, trailers
Write Func[1:00F80] = Len:0001x0080 02 00 48 00 08 20 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 00 38 AA AA 03 00 00 00 08 00 45 00 00 30 00 10 00 00 80 06 DE 5D C0 A8 01 1E 58 C6 41 CE 12 EA 00 50 F1 DE 70 7B 00 00 00 00 70 02 80 00 31 94 00 00 02 04 05 50 01 01 04 02
Write Func[1:00D80] = Len:0005x0080 02 01 20 02 00 00 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 02 10 AA AA 03 00 00 00 08 00 45 00 02 08 00 11 00 00 80 06 DC 84 C0 A8 01 1E 58 C6 41 CE 12 E9 00 50 1A 83 7E D4 21 7A 74 27 50 18 78 6D FA 99 00 00 GET /char-n.gif HTTP/1.1User-Agent: Opera/9.50 (Nintendo DSi; Opera/507; U; en-GB)Host: problemkaputt.deAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: enAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0Referer: http://problemkaputt.de/Connection: Keep-Alive, TETE: deflate, gzip, chunked, identity, trailers
Write Func[1:00F80] = Len:0001x0080 02 00 40 00 08 20 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 00 30 AA AA 03 00 00 00 08 00 45 00 00 28 00 12 00 00 80 06 DE 63 C0 A8 01 1E 58 C6 41 CE 12 EA 00 50 F1 DE 70 7C 0E B3 15 F9 50 10 80 00 39 38 00 00
Delay 0002
Write Func[1:00D80] = Len:0005x0080 02 01 20 02 00 00 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 02 10 AA AA 03 00 00 00 08 00 45 00 02 08 00 13 00 00 80 06 DC 82 C0 A8 01 1E 58 C6 41 CE 12 E9 00 50 1A 83 80 B4 21 7A 76 06 50 18 76 8E 05 BA 00 00 GET /char-a.gif HTTP/1.1User-Agent: Opera/9.50 (Nintendo DSi; Opera/507; U; en-GB)Host: problemkaputt.deAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: enAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0Referer: http://problemkaputt.de/Connection: Keep-Alive, TETE: deflate, gzip, chunked, identity, trailers
Write Func[1:00D80] = Len:0005x0080 02 00 20 02 00 00 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 02 10 AA AA 03 00 00 00 08 00 45 00 02 08 00 14 00 00 80 06 DC 81 C0 A8 01 1E 58 C6 41 CE 12 E9 00 50 1A 83 82 94 21 7A 77 DA 50 18 74 BA FF D9 00 00 GET /char-e.gif HTTP/1.1User-Agent: Opera/9.50 (Nintendo DSi; Opera/507; U; en-GB)Host: problemkaputt.deAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: enAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0Referer: http://problemkaputt.de/Connection: Keep-Alive, TETE: deflate, gzip, chunked, identity, trailers
Delay 0003
Write Func[1:00D80] = Len:0005x0080 02 00 1D 02 00 00 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 02 0D AA AA 03 00 00 00 08 00 45 00 02 05 00 15 00 00 80 06 DC 83 C0 A8 01 1E 58 C6 41 CE 12 E9 00 50 1A 83 84 74 21 7A 79 A8 50 18 72 EC 60 7D 00 00 GET /yep.gif HTTP/1.1User-Agent: Opera/9.50 (Nintendo DSi; Opera/507; U; en-GB)Host: problemkaputt.deAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: enAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0Referer: http://problemkaputt.de/Connection: Keep-Alive, TETE: deflate, gzip, chunked, identity, trailers
Delay 000B
Write Func[1:00F80] = Len:0001x0080 02 00 40 00 08 20 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 00 30 AA AA 03 00 00 00 08 00 45 00 00 28 00 16 00 00 80 06 DE 5F C0 A8 01 1E 58 C6 41 CE 12 E9 00 50 1A 83 86 51 21 7A 7B 57 50 10 71 3D 91 5D 00 00
Delay 0005
Write Func[1:00D80] = Len:0005x0080 02 01 20 02 00 00 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 02 10 AA AA 03 00 00 00 08 00 45 00 02 08 00 17 00 00 80 06 DC 7E C0 A8 01 1E 58 C6 41 CE 12 E9 00 50 1A 83 86 51 21 7A 7B 57 50 18 80 00 DD 59 00 00 GET /char-u.gif HTTP/1.1User-Agent: Opera/9.50 (Nintendo DSi; Opera/507; U; en-GB)Host: problemkaputt.deAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: enAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0Referer: http://problemkaputt.de/Connection: Keep-Alive, TETE: deflate, gzip, chunked, identity, trailers
Write Func[1:00D80] = Len:0005x0080 02 00 20 02 00 00 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 02 10 AA AA 03 00 00 00 08 00 45 00 02 08 00 18 00 00 80 06 DC 7D C0 A8 01 1E 58 C6 41 CE 12 EA 00 50 F1 DE 70 7C 0E B3 15 F9 50 18 80 00 91 F7 00 00 GET /char-w.gif HTTP/1.1User-Agent: Opera/9.50 (Nintendo DSi; Opera/507; U; en-GB)Host: problemkaputt.deAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: enAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0Referer: http://problemkaputt.de/Connection: Keep-Alive, TETE: deflate, gzip, chunked, identity, trailers
Write Func[1:00D80] = Len:0005x0080 02 00 20 02 00 00 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 02 10 AA AA 03 00 00 00 08 00 45 00 02 08 00 19 00 00 80 06 DC 7C C0 A8 01 1E 58 C6 41 CE 12 EA 00 50 F1 DE 72 5C 0E B3 17 D3 50 18 7E 26 95 17 00 00 GET /char-r.gif HTTP/1.1User-Agent: Opera/9.50 (Nintendo DSi; Opera/507; U; en-GB)Host: problemkaputt.deAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: enAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0Referer: http://problemkaputt.de/Connection: Keep-Alive, TETE: deflate, gzip, chunked, identity, trailers
Write Func[1:00D80] = Len:0005x0080 02 00 21 02 00 00 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 02 11 AA AA 03 00 00 00 08 00 45 00 02 09 00 1A 00 00 80 06 DC 7A C0 A8 01 1E 58 C6 41 CE 12 EA 00 50 F1 DE 74 3C 0E B3 19 AD 50 18 7C 4C 2C 32 00 00 GET /breath2.gif HTTP/1.1User-Agent: Opera/9.50 (Nintendo DSi; Opera/507; U; en-GB)Host: problemkaputt.deAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: enAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0Referer: http://problemkaputt.de/Connection: Keep-Alive, TETE: deflate, gzip, chunked, identity, trailers
Write Func[1:00F80] = Len:0001x0080 01 01 0E 00 02 00 002E WMIX_HB_CHALLENGE_RESP_CMD           08 20 00 00 19 00 00 00 00 00 00 00
Write Func[1:00F80] = Len:0001x0080 02 00 40 00 08 20 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 00 30 AA AA 03 00 00 00 08 00 45 00 00 28 00 1B 00 00 80 06 DE 5A C0 A8 01 1E 58 C6 41 CE 12 EA 00 50 F1 DE 76 1D 0E B3 24 4D 50 10 71 AC 33 97 00 00
Write Func[1:00F80] = Len:0001x0080 02 01 40 00 08 20 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 00 30 AA AA 03 00 00 00 08 00 45 00 00 28 00 1D 00 00 80 06 DE 58 C0 A8 01 1E 58 C6 41 CE 12 EA 00 50 F1 DE 77 FD 0E B3 2E ED 50 10 67 0C 31 B7 00 00
Write Func[1:00F80] = Len:0001x0080 02 00 40 00 08 20 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 00 30 AA AA 03 00 00 00 08 00 45 00 00 28 00 1E 00 00 80 06 DE 57 C0 A8 01 1E 58 C6 41 CE 12 EA 00 50 F1 DE 77 FD 0E B3 39 8D 50 10 5C 6C 31 B7 00 00
Write Func[1:00D80] = Len:0005x0080 02 00 20 02 00 00 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 02 10 AA AA 03 00 00 00 08 00 45 00 02 08 00 1C 00 00 80 06 DC 79 C0 A8 01 1E 58 C6 41 CE 12 EA 00 50 F1 DE 76 1D 0E B3 24 4D 50 18 71 AC A3 F1 00 00 GET /nonazi.gif HTTP/1.1User-Agent: Opera/9.50 (Nintendo DSi; Opera/507; U; en-GB)Host: problemkaputt.deAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: enAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0Referer: http://problemkaputt.de/Connection: Keep-Alive, TETE: deflate, gzip, chunked, identity, trailers
Write Func[1:00F80] = Len:0001x0080 02 00 40 00 08 20 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 00 30 AA AA 03 00 00 00 08 00 45 00 00 28 00 20 00 00 80 06 DE 55 C0 A8 01 1E 58 C6 41 CE 12 EA 00 50 F1 DE 77 FD 0E B3 4B 9A 50 10 62 5F 19 B7 00 00
Write Func[1:00F80] = Len:0001x0080 02 01 40 00 08 20 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 00 30 AA AA 03 00 00 00 08 00 45 00 00 28 00 21 00 00 80 06 DE 54 C0 A8 01 1E 58 C6 41 CE 12 E9 00 50 1A 83 88 31 21 7A 7D 2A 50 10 7E 2D 80 BA 00 00
Write Func[1:00F80] = Len:0001x0080 02 00 40 00 08 20 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 00 30 AA AA 03 00 00 00 08 00 45 00 00 28 00 22 00 00 80 06 DE 53 C0 A8 01 1E 58 C6 41 CE 12 EA 00 50 F1 DE 77 FD 0E B3 56 3A 50 10 57 BF 19 B7 00 00
Write Func[1:00F80] = Len:0001x0080 02 01 40 00 08 20 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 00 30 AA AA 03 00 00 00 08 00 45 00 00 28 00 23 00 00 80 06 DE 52 C0 A8 01 1E 58 C6 41 CE 12 EA 00 50 F1 DE 77 FD 0E B3 5C 7F 50 10 51 7A 19 B7 00 00
Delay 0002
Write Func[1:00D80] = Len:0005x0080 02 00 20 02 00 00 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 02 10 AA AA 03 00 00 00 08 00 45 00 02 08 00 24 00 00 80 06 DC 71 C0 A8 01 1E 58 C6 41 CE 12 E9 00 50 1A 83 88 31 21 7A 7D 2A 50 18 7E 2D F1 14 00 00 GET /nonazi.gif HTTP/1.1User-Agent: Opera/9.50 (Nintendo DSi; Opera/507; U; en-GB)Host: problemkaputt.deAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: enAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0Referer: http://problemkaputt.de/Connection: Keep-Alive, TETE: deflate, gzip, chunked, identity, trailers
Write Func[1:00F80] = Len:0001x0080 02 00 40 00 08 20 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 00 30 AA AA 03 00 00 00 08 00 45 00 00 28 00 25 00 00 80 06 DE 50 C0 A8 01 1E 58 C6 41 CE 12 E9 00 50 1A 83 8A 11 21 7A 87 CA 50 10 73 8D 7E DA 00 00
Write Func[1:00F80] = Len:0001x0080 02 01 40 00 08 20 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 00 30 AA AA 03 00 00 00 08 00 45 00 00 28 00 26 00 00 80 06 DE 4F C0 A8 01 1E 58 C6 41 CE 12 E9 00 50 1A 83 8A 11 21 7A 92 6A 50 10 68 ED 7E DA 00 00
Write Func[1:00F80] = Len:0001x0080 02 00 40 00 08 20 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 00 30 AA AA 03 00 00 00 08 00 45 00 00 28 00 27 00 00 80 06 DE 4E C0 A8 01 1E 58 C6 41 CE 12 E9 00 50 1A 83 8A 11 21 7A 93 5F 50 10 80 00 66 D2 00 00
Delay 0006
Write Func[1:00F80] = Len:0001x0080 02 01 40 00 08 20 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 00 30 AA AA 03 00 00 00 08 00 45 00 00 28 00 28 00 00 80 06 DE 4D C0 A8 01 1E 58 C6 41 CE 12 EA 00 50 F1 DE 77 FD 0E B3 5C 7F 50 10 80 00 EB 30 00 00
Delay 0008
Write Func[1:00F80] = Len:0001x0080 02 00 40 00 08 20 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 00 30 AA AA 03 00 00 00 08 00 45 00 00 28 00 29 00 00 80 06 DE 4C C0 A8 01 1E 58 C6 41 CE 12 EA 00 50 F1 DE 77 FD 0E B3 5C 7F 50 11 80 00 EB 2F 00 00
Write Func[1:00F80] = Len:0001x0080 02 00 40 00 08 20 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 00 30 AA AA 03 00 00 00 08 00 45 00 00 28 00 2A 00 00 80 06 DE 4B C0 A8 01 1E 58 C6 41 CE 12 EA 00 50 F1 DE 77 FE 0E B3 5C 80 50 10 80 00 EB 2E 00 00
Delay 0003
Write Func[1:00D80] = Len:0005x0080 02 01 21 02 00 00 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 02 11 AA AA 03 00 00 00 08 00 45 00 02 09 00 2B 00 00 80 06 DC 69 C0 A8 01 1E 58 C6 41 CE 12 E9 00 50 1A 83 8A 11 21 7A 93 5F 50 18 80 00 65 41 00 00 GET /favicon.ico HTTP/1.1User-Agent: Opera/9.50 (Nintendo DSi; Opera/507; U; en-GB)Host: problemkaputt.deAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: enAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0Referer: http://problemkaputt.de/Connection: Keep-Alive, TETE: deflate, gzip, chunked, identity, trailer
Write Func[1:00F80] = Len:0001x0080 02 00 40 00 08 20 0000   (data)                             bb bb bb bb bb bb mm mm mm mm mm mm 00 30 AA AA 03 00 00 00 08 00 45 00 00 28 00 2C 00 00 80 06 DE 49 C0 A8 01 1E 58 C6 41 CE 12 E9 00 50 1A 83 8B F2 21 7A 99 2D 50 10 7A 32 64 F1 00 00
Delay 0012+0009
Write Func[1:00F80] = Len:0001x0080 01 01 0E 00 02 00 002E WMIX_HB_CHALLENGE_RESP_CMD           08 20 00 00 1A 00 00 00 00 00 00 00
Delay 0023+0018
Write Func[1:00F80] = Len:0001x0080 01 01 0E 00 02 00 002E WMIX_HB_CHALLENGE_RESP_CMD           08 20 00 00 1B 00 00 00 00 00 00 00
Delay 0008+000B

DSi Atheros Wifi - MBOX Transfer Headers
----------------------------------------

MBOX transfers include a small header for distinguishing between Data Packets
and Commands/Events, and for indicating the actual length (as opposed to the
MBOX transfer length, which is usually garbage-padded to 80h-byte boundary).
The exception are BMI Bootloader commands/responses (which don't have such
headers or padding).

SDIO Functions used after BMI init
  Func[0:00005h]        R   1     Interrupt Flags (bit1=Function 1 IRQ)
  Func[1:00400h]        R   10h   Interrupt Status, etc.
  Func[1:00474h]        R   4     WINDOW DATA (uh, without prior ADDR ?)
  Func[1:00xxxh..00FFF] R/W ..    MBOX0

 ________________________________ Send Headers ________________________________

Header for Sending UNKNOWN Crap
  00h 1  Must be 00h for UNKNOWN Crap
  01h 1  <Unknown1>?? 00h
  02h 2  Length of entries [06h..end]
  04h 2  <Unknown4>?? 0000h
  06h 2  <Unknown6>?? 0002h or 0004h
  08h .. Unknown Parameters (if any)
DSi Browser is sending six such unknown crap things right after the BMI phase.
Purpose is totally unknown, however, one could just send the same crap without
knowning its purpose.

Header for Sending WMI Commands
  00h 1  Must be 01h for WMI Commands
  01h 1  <Unknown1>?? 01h
  02h 2  Length of entries [06h..end]
  04h 2  <Unknown4>?? 0000h, or 0101h/0002h/0102h=HB, or 2008h=2ndCipherKey???
  06h 2  WMI Command Number
  08h .. Parameters (plus leading 4-byte command suffix if CMD=002Eh:000020xxh)
Unknown4 looks kinda random/garbage (eg. 2008h occurs in 2nd CIPHER_KEY, and in
4th PSTREAM command), in so far it's apparently unrelated to the current
command (however, it might be a reply/ack for some previous stuff?).

Header for Sending DATA Packets
  00h 1  Must be 02h for DATA Packets
  01h 1  <Unknown1>?? 00h or 01h        ;maybe two "channels" for simult. GETs?
  02h 2  Length of entries [06h..end]
  04h 2  <Unknown4>?? 0000h or 2008h    ;maybe related to cmd 002Eh:2008h ?
  06h 2  <Unknown6>?? 0000h or 1C00h    ;maybe whatever ?
  08h 6  Destination (MAC Addr of Router) (or FF:FF:FF:FF:FF:FF=Broadcast)
  0Eh 6  Source      (MAC Addr of DSi console)
  14h 2  Length of entries [16h..end]
  16h .. Data (usually starting with LLC stuff, ie. AAh,AAh,03h,00h...)

 ______________________________ Receive Headers ______________________________

Header for Receiving UNKNOWN Crap
  00h 1  Must be 00h for UNKNOWN Crap
  01h .. <Unknown1>?? 00h
DSi Browser is receiving six such unknown crap things right after the BMI
phase. Purpose is totally unknown, however, one could just sent same replies as
being used by the DSi browser.
Moreover, DSi Browser is receiving MORE such unknown crap every once and then,
maybe containing ACKs or other handshake info?

Header for Receiving WMI Events
  00h 1  Must be 01h for WMI Events
  01h 1  <Unknown1>?? 02h    ;EDIT: actually 00h or 02h
  02h 2  Length of entries [06h..end]
  04h 2  <Unknown4>?? 0008h, 000Ch, or FF08h
  06h 2  WMI Event Number
  08h .. Parameters

Header for Receiving DATA Packets
  00h 1  Must be 02h for DATA Packets
  01h 1  <Unknown1>?? 00h or 01h or 02h   ;EDIT: actually always 02h
  02h 2  Length of entries [06h..end]
  04h 2  <Unknown4>?? 0000h, 0008h, 000Ch, 2008h, 7F08h, F408h, F40Ch, FF08h
  06h 1  RSSI (Received Signal Strength Indicator) (00h..3Ch) (aka 0..60)
  07h 1  <Unknown7> 00h
  08h 6  Whatever Address (MAC Addr of Router)        ;\or sometimes swapped?
  0Eh 6  Whatever Address (MAC Addr of DSi console)   ;/
  14h 2  Length of entries [16h..end]
  16h .. Data (usually LLC stuff, ie. AAh,AAh,03h.. or, once F0h,F0h,03h..??)

   bad:
Read  Mem[00520001] = 00520000                    ;this is a logging error (the 3-step MemRead had collided with REGDOMAIN event)
Read  Func[1:00400] = Len:0001x0010 00 00 04 00 0F 00 0F 00 00 00 00 00 00 BC 1A 91
Read  Func[1:00474] = Len:0001x0004 A0 B2 52 00   ;this is final step of above mis-logged MemRead
Write Mem[0052B2A0] = 00000002
   correct:
Read  Mem[005200...                               ;ReadMem addr.msbs (then gets interrupted by event...)
Read  Func[1:00F80] = Len:0001x0080 01 02 0E 00 08 00 06 10 48 03 00 80 02 06 00 00 00 00 00 00   ;REGDOMAIN event
Write Func[1:0047C] = Len:0001x0001 00            ;ReadMem addr.lsb ;[......00]
Read  Func[1:00400] = Len:0001x0010 00 00 04 00 0F 00 0F 00 00 00 00 00 00 3C 1A 11
Read  Func[1:00474] = Len:0001x0004 A0 B2 52 00   ;ReadMem data  ;Mem[00520000] = 0052B2A0
Write Mem[0052B2A0] = 00000002

  arm7_installWifiFIFO
  arm7_wifiValue32Handler   ;this includes Init (from ARM9 via FIFO)
  arm7_Wifi_Update
  arm7_Wifi_Deinit
  arm7_Wifi_Interrupt
  IRQ_WIFI (add IRQ2_DSI_WIFI, and don't forget adding IRQ2_ALL)

connection details:
 access point:     fritzbox (with SSID "ead")
 encryption:       WPA-PSK(TKIP)
 password:         ernstaugustdeich
 modus:            infrastruktur
 groupkeyinterval: 3600 seconds
 MAC for DSi       mm mm mm mm mm mm
 MAC for AP        aa aa aa aa aa aa
 MAC for router    bb bb bb bb bb bb

MBOX traffic for sdio_connect sequence:
 (preceeded by usual channel scanning stuff)
 Write WMI_TARGET_ERROR_REPORT_BITMASK_CMD +2008h    01 01 06 00 08 20  22 00 7F 00 00 00
 Write WMI_SET_BSS_FILTER_CMD                        01 01 0A 00 00 00  09 00 00 00 00 00 00 00 00 00
 Write WMI_SET_PROBED_SSID_CMD                       01 01 25 00 00 00  0A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 Write WMI_SET_SCAN_PARAMS_CMD                       01 01 16 00 00 00  08 00 FF FF FF FF FF FF C8 00 C8 00 00 05 C8 00 00 00 00 00 00 00
 Write WMI_SET_CHANNEL_PARAMS_CMD                    01 01 08 00 00 00  11 00 00 00 02 01 9E 09
 Write WMI_SET_BITRATE_CMD                           01 01 05 00 00 00  00 F0 FF 00 00
 Write WMI_SET_AP_PS_CMD                             01 01 06 00 00 00  48 00 01 A4 F7 FF
 Write WMI_SYNCHRONIZE_CMD                           01 01 03 00 00 00  04 00 00
 Write WMI_SET_POWER_MODE_CMD                        01 01 03 00 00 00  12 00 02
 Write WMI_SYNCHRONIZE_CMD                           01 01 03 00 00 00  04 00 00
 Write WMI_CREATE_PSTREAM_CMD                        01 01 41 00 00 00  05 00 14 00 00 00 14 00 00 00 7F 96 98 00 FF FF FF FF 00 00 00 00 00 45 01 00 00 45 01 00 00 45 01 00 00 00 00 00 00 00 00 00 80 8D 5B 00 00 20 00 00 00 00 00 00 D0 80 D0 00 00 02 FF 01 00 05 00
 Write WMI_SET_WSC_STATUS_CMD                        01 01 03 00 00 00  41 00 00
 Write WMI_SET_DISCONNECT_TIMEOUT(_CMD)              01 01 03 00 00 00  0D 00 02
 Write WMI_SET_TKIP_COUNTERMEASURES_CMD  !!!         01 01 03 00 00 00  20 00 00
 Write WMI_SET_BSS_FILTER_CMD                        01 01 0A 00 00 00  09 00 00 00 00 00 00 00 00 00
 Write WMI_SET_SCAN_PARAMS_CMD                       01 01 16 00 00 00  08 00 FF FF FF FF FF FF C8 00 C8 00 00 05 C8 00 00 00 00 00 00 00
 Write WMI_SET_CHANNEL_PARAMS_CMD +2008h             01 01 08 00 08 20  11 00 00 00 02 01 9E 09
 Write WMI_SET_KEEPALIVE_CMD                         01 01 03 00 00 00  3D 00 00
 Write WMI_CONNECT_CMD      ;<----------             01 01 36 00 00 00  01 00 01 01 03 03 00 03 00 03 65 61 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9E 09 aa aa aa aa aa aa 00 00 00 00   ;connect to "ead"
 Read  WMIX_DBGLOG_EVENT                             01 00 E2 05 00 00  10 10 08 30 00 00 00 00 00 00 F1 05 2C 44 08 30 00 00 2C 06 29 84 07 00 00 00 14 00 00 00 2C 06 06 A4 ...
 Write WMIX_HB_CHALLENGE_RESP_CMD          +0101h    01 01 0E 00 01 01  2E 00 08 20 00 00 02 00 00 00 00 00 00 00
 Read  WMIX_HB_CHALLENGE_RESP_EVENT                  01 02 16 00 08 00  10 10 07 30 00 00 02 00 00 00 00 00 00 00 02 06 00 00 02 0C 00 00
 Delay 0009 till IRQ
 Read  WMI_CONNECT_EVENT    ;<----------             01 02 7F 00 08 00  02 10 9E 09 aa aa aa aa aa aa 64 00 64 00 01 00 00 00 1A 31 16 DD 18 00 50 F2 01 01 00 00 50 F2 02 01 00 00 50 F2 02 01 00 00 50 F2 02 00 00 11 04 01 00 00 03 65 61 64 01 08 82 84 8B 0C 12 96 18 24 32 04 30 48 60 6C DD 16 00 50 F2 01 01 00 00 50 F2 02 01 00 00 50 F2 02 01 00 00 50 F2 02 51 04 00 00 01 C0 01 08 82 84 8B 0C 12 96 18 24 32 04 30 48 60 6C 00 02 06 00 00 00 00 00 00    ;for "ead"
 Read  Data #1 read                                  02 02 83 00 08 F4  3B 00 mm mm mm mm mm mm aa aa aa aa aa aa 00 6B AA AA 03 00 00 00 88 8E 01 03 00 5F FE 00 89 00 20 00 00 00 00 00 00 00 01 0A E4 4D E8 8F 91 BA DA 89 73 78 7E 46 AF 28 97 9E C7 97 80 A7 20 4B 53 71 F6 27 F7 62 A7 B4 D9 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 06 00 A5 A5 01 00 00
 Write Data #2 write                                 02 00 93 00 00 00  00 1C aa aa aa aa aa aa mm mm mm mm mm mm 00 83 AA AA 03 00 00 00 88 8E 01 03 00 77 FE 01 09 00 20 00 00 00 00 00 00 00 01 B1 F9 1C 00 66 00 55 8F 42 F7 07 F4 00 01 10 01 01 27 40 00 00 00 00 00 7F 06 9C 6C FF 2F B6 C7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1B 1E 61 E7 C3 1F CF 0D 88 9F 7B E9 27 4B 80 AA 00 18 DD 16 00 50 F2 01 01 00 00 50 F2 02 01 00 00 50 F2 02 01 00 00 50 F2 02
 Read  Data #3 read                                  02 02 A1 00 0C F4  3B 00 mm mm mm mm mm mm aa aa aa aa aa aa 00 85 AA AA 03 00 00 00 88 8E 01 03 00 79 FE 01 C9 00 20 00 00 00 00 00 00 00 02 0A E4 4D E8 8F 91 BA DA 89 73 78 7E 46 AF 28 97 9E C7 97 80 A7 20 4B 53 71 F6 27 F7 62 A7 B4 D9 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 7A 4F 98 41 29 D5 BF 43 04 58 74 E2 3E 8E 10 00 1A DD 18 00 50 F2 01 01 00 00 50 F2 02 01 00 00 50 F2 02 01 00 00 50 F2 02 00 00 01 02 02 01 02 06 00 14 00 0A 00 00
 Write Data #4 write                                 02 00 7B 00 00 00  00 1C aa aa aa aa aa aa mm mm mm mm mm mm 00 6B AA AA 03 00 00 00 88 8E 01 03 00 5F FE 01 09 00 20 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 95 53 EE 13 CE 18 28 7C 50 87 C1 78 54 67 E4 B7 00 00
 Write WMI_SYNCHRONIZE_CMD                           01 01 03 00 00 00  04 00 01
 Write Data #5 write n/a +0204h                      02 01 02 00 00 00  04 02
 Write Data #6 write n/a +0204h                      02 00 02 00 00 00  04 02
 Write WMI_ADD_CIPHER_KEY_CMD      ;<---             01 01 2F 00 00 00  16 00 00 03 00 20 00 00 00 00 00 00 00 00 07 A2 68 3A DF B2 B5 29 2F 82 70 8E 0F C0 CB 0E 9B 5F AE 0F 0F EB 79 18 F2 BC 3A FA EA 12 FB 3C 03
 Read   (handshake with len=0Eh) (acklen=4) (!!!)    00 02 0E 00 0E 00  01 04 01 01 02 01 02 06 00 00 00 00 00 00  ;(this isn't WPA related, just interesting because it does deliver a "Cmd.ack" and "Data.ack" in the same packet)
 Write WMI_SYNCHRONIZE_CMD                           01 01 03 00 00 00  04 00 01
 Read  Data #7 read                                  02 02 A3 00 08 F4  3B 00 mm mm mm mm mm mm aa aa aa aa aa aa 00 8B AA AA 03 00 00 00 88 8E 01 03 00 7F FE 03 A1 00 20 00 00 00 00 00 00 00 03 0A E4 4D E8 8F 91 BA DA 89 73 78 7E 46 AF 28 97 9E C7 97 80 A7 20 4B 53 71 F6 27 F7 62 A7 B4 D8 9E C7 97 80 A7 20 4B 53 71 F6 27 F7 62 A7 B4 DA 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8B 0D 67 18 1E B2 81 48 02 9D 84 6A 0B DC 03 48 00 20 04 4C 38 D8 37 85 D8 75 D2 C7 AD 15 F9 F8 32 78 96 BE 01 97 0C 5F 9F A9 6E B6 9C 5B 3C 3C 5B 16 02 06 00 DB 2A 92 8A 00
 Write WMI_SYNCHRONIZE_CMD                           01 01 03 00 00 00  04 00 01
 Write Data #8 write n/a +020Dh                      02 00 02 00 00 00  0D 02
 Write Data #9 write n/a +0209h                      02 00 02 00 00 00  09 02
 Write WMI_ADD_CIPHER_KEY_CMD      ;<---             01 01 2F 00 00 00  16 00 02 03 01 20 00 00 00 00 00 00 00 00 44 9B 5A DC 41 27 79 2E ED 65 AA 1F D3 65 36 2F 02 A4 1B DD B8 2B 2F 39 84 D0 69 6F 46 E4 55 53 03
 Write WMI_SYNCHRONIZE_CMD                           01 01 03 00 00 00  04 00 01
 Write Data #10 write                                02 00 7B 00 00 00  00 1C aa aa aa aa aa aa mm mm mm mm mm mm 00 6B AA AA 03 00 00 00 88 8E 01 03 00 5F FE 03 21 00 20 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 A2 B7 B0 78 07 D3 67 C8 1B C9 ED 4B 55 20 E1 00 00
 Delay 001A till IRQ
 Read  WMI_NEIGHBOR_REPORT_EVENT                     01 02 16 00 0C 00  08 10 01 aa aa aa aa aa aa 00 01 02 02 01 02 06 00 00 1A 31 16 00
 Delay 0010 till heartbeat
 Write WMIX_HB_CHALLENGE_RESP_CMD          +0101h    01 01 0E 00 01 01  2E 00 08 20 00 00 03 00 00 00 00 00 00 00
 Read  WMIX_HB_CHALLENGE_RESP_EVENT                  01 02 16 00 08 00  10 10 07 30 00 00 03 00 00 00 00 00 00 00 02 06 00 00 1A 31 16 00
 Delay 0006 till IRQ
 Read  Data #11 read                                 02 02 4E 00 08 00  3B 00 01 00 5E 00 00 01 bb bb bb bb bb bb 00 36 AA AA 03 00 00 00 08 00 46 00 00 20 00 00 40 00 01 02 43 2D C0 A8 01 01 E0 00 00 01 94 04 00 00 11 0A EE F5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 06 00 CC 65 A2 27 00
 Delay 000B till IRQ
 Read  Data #12 read                                 02 02 40 00 08 7F  3C 00 01 00 5E 7F FF FA bb bb bb bb bb bb 00 28 AA AA 03 00 00 00 08 00 46 00 00 20 00 00 40 00 01 02 33 2E C0 A8 01 07 EF FF FF FA 94 04 00 00 16 00 FA 04 EF FF FF FA 02 06 00 25 16 2F E3 00
 (followed by usual DHCP stuff)

---------------------------------------------------------------------------------------------------------
WPA2 Data #1 read
  8    WMI header (02 02 83 00 08 F4  32 00)
  12   MAC addresses (mm mm mm mm mm mm aa aa aa aa aa aa)
  2    Length (00 6B)
  8    LLC/SNAP (AA AA 03 00 00 00 88 8E)
  2    ?  01 03
  2    Length (00 5F)
  12   ?  02 00 8A 00 10 00 00 00 00 00 00 00
  1    ?  01
  32   ?  32 0A B2 DC 9B AB CE 36 B4 B1 6E DF 4B 76 62 00 9C 41 90 12 64 17 4A 4F C6 28 0C 89 BF 73 54 90
  32   ?  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  16   ?  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  2    ?  00 00
  8    WMI handshake info (02 06 00 3B 3B 00 00 00)
---------------------------------------------------------------------------------------------------------
<snip> EDIT: see next post for better break down

---------------------------------------------------------------------------------------------------------
WPA Data #1 read
  8    WMI header (02 02 83 00 08 F4  3B 00)
  12   MAC addresses (mm mm mm mm mm mm aa aa aa aa aa aa)
  2    Length (00 6B)
  8    LLC/SNAP (AA AA 03 00 00 00 88 8E)
  2    ?  01 03              ;version, type?
  2    Length (00 5F)
  12      FE 00 89 00 20 00 00 00 00 00 00 00
  1    ?  01
  32   ?  0A E4 4D E8 8F 91 BA DA 89 73 78 7E 46 AF 28 97 9E C7 97 80 A7 20 4B 53 71 F6 27 F7 62 A7 B4 D9
  32   ?  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  16   ?  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  2    ?  00 00
  8    WMI handshake (02 06 00 A5 A5 01 00 00)
---------------------------------------------------------------------------------------------------------
<snip> EDIT: see next post for better break down

---------------------------------------------------------------------------------------------------------
WPA2 Data #1 read
  8    WMI header (02 02 83 00 08 F4  32 00)
  12   MAC addresses (mm mm mm mm mm mm aa aa aa aa aa aa)
  2    Length (00 6B)
  8    LLC/SNAP (AA AA 03 00 00 00 88 8E)
  2    ?  01 03
  2    Length (00 5F)
  1    Descriptor Type    (02)
  2    Key Information    (00 8A)
  2    Key Length         (00 10)
  8    Key Replay Counter (00 00 00 00 00 00 00 01)
  32   Key Nonce          (32 0A B2 DC 9B AB CE 36 B4 B1 6E DF 4B 76 62 00 9C 41 90 12 64 17 4A 4F C6 28 0C 89 BF 73 54 90)
  16   EAPOL Key IV       (00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00)
  8    Key RSC            (00 00 00 00 00 00 00 00)
  8    Reserved           (00 00 00 00 00 00 00 00)
  16   Key MIC            (00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00)
  2    Key Data Length    (00 00)
  8    WMI handshake info (02 06 00 3B 3B 00 00 00)
---------------------------------------------------------------------------------------------------------
WPA2 Data #2 write
  8    WMI header (02 00 91 00 00 00  00 1C)
  12   MAC addresses (aa aa aa aa aa aa mm mm mm mm mm mm)
  2    Length (00 81)
  8    LLC/SNAP (AA AA 03 00 00 00 88 8E)
  2    ?  01 03
  2    Length (00 75)
  1    Descriptor Type    (02)
  2    Key Information    (01 0A)
  2    Key Length         (00 00)
  8    Key Replay Counter (00 00 00 00 00 00 00 01)
  32   Key Nonce          (A8 DC C3 00 67 00 55 8F 49 F7 07 F4 00 01 10 01 60 16 15 00 00 00 00 00 7F 06 9C 6C FF 2F 61 22)
  16   EAPOL Key IV       (00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00)
  8    Key RSC            (00 00 00 00 00 00 00 00)
  8    Reserved           (00 00 00 00 00 00 00 00)
  16   Key MIC            (B9 FA 85 43 28 AC 29 67 36 A8 1E 44 6E 69 08 E9)
  2    Key Data Length    (00 16)
  ..   Key Data           (30 14 01 00 00 0F AC 04 01 00 00 0F AC 04 01 00 00 0F AC 02 00 00)
---------------------------------------------------------------------------------------------------------
WPA2 Data #3 read
  8    WMI header (02 02 BF 00 0C F4  33 00)
  12   MAC addresses (mm mm mm mm mm mm aa aa aa aa aa aa)
  2    Length (00 A3)
  8    LLC/SNAP (AA AA 03 00 00 00 88 8E)
  2    ?  01 03
  2    Length (00 97)
  1    Descriptor Type    (02)
  2    Key Information    (13 CA)
  2    Key Length         (00 10)
  8    Key Replay Counter (00 00 00 00 00 00 00 02)
  32   Key Nonce          (32 0A B2 DC 9B AB CE 36 B4 B1 6E DF 4B 76 62 00 9C 41 90 12 64 17 4A 4F C6 28 0C 89 BF 73 54 90)  ;<-- same as in #1
  16   EAPOL Key IV       (A6 A6 A6 A6 A6 A6 A6 A6 00 00 00 00 00 00 00 00)
  8    Key RSC            (00 00 00 00 00 00 00 00)
  8    Reserved           (00 00 00 00 00 00 00 00)
  16   Key MIC            (05 85 CB E1 56 2B 42 10 A8 5D 54 F8 2A ED 50 4D)
  2    Key Data Length    (00 38)
  ..   Key Data           (34 FC 74 21 0D BB C0 B9 89 E2 D9 D4 B4 58 E1 67 7B D0 9B BC 31 C8 42 0A 97 0D AD A1 11 7A E3 48 48 BF B5 FB 48 69 45 D0 CF F1 49 24 EE 90 D8 5B 61 7B 3E 31 67 24 E9 41)
  4    WMI handshake info (01 02 02 01)
  8    WMI handshake info (02 06 00 2F 00 DD 1E 00)
---------------------------------------------------------------------------------------------------------
WPA2 Data #4 write
  8    WMI header (02 00 7B 00 00 00  00 1C)
  12   MAC addresses (aa aa aa aa aa aa mm mm mm mm mm mm)
  2    Length (00 6B)
  8    LLC/SNAP (AA AA 03 00 00 00 88 8E)
  2    ?  01 03
  2    Length (00 5F)
  1    Descriptor Type    (02)
  2    Key Information    (03 0A)
  2    Key Length         (00 00)
  8    Key Replay Counter (00 00 00 00 00 00 00 02)
  32   Key Nonce          (00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00)
  16   EAPOL Key IV       (00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00)
  8    Key RSC            (00 00 00 00 00 00 00 00)
  8    Reserved           (00 00 00 00 00 00 00 00)
  16   Key MIC            (DE 4B 9C F1 B8 C3 D3 D0 04 2F 49 8B 97 12 23 C2)
  2    Key Data Length    (00 00)
---------------------------------------------------------------------------------------------------------

---------------------------------------------------------------------------------------------------------
WPA Data #1 read -- matches "IEEE Std 802.11i-2004"
  8    WMI header (02 02 83 00 08 F4  3B 00)
  12   MAC addresses (mm mm mm mm mm mm aa aa aa aa aa aa)
  2    Length (00 6B)
  8    LLC/SNAP (AA AA 03 00 00 00 88 8E)
  2    ?  01 03              ;version, type?
  2    Length (00 5F)
  1    Descriptor Type    (FE)
  2    Key Information    (00 89)
  2    Key Length         (00 20)
  8    Key Replay Counter (00 00 00 00 00 00 00 01)
  32   Key Nonce          (0A E4 4D E8 8F 91 BA DA 89 73 78 7E 46 AF 28 97 9E C7 97 80 A7 20 4B 53 71 F6 27 F7 62 A7 B4 D9)
  16   EAPOL Key IV       (00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00)
  8    Key RSC            (00 00 00 00 00 00 00 00)
  8    Reserved           (00 00 00 00 00 00 00 00)
  16   Key MIC            (00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00)
  2    Key Data Length    (00 00)
  8    WMI handshake (02 06 00 A5 A5 01 00 00)
---------------------------------------------------------------------------------------------------------
WPA Data #2 write
  8    WMI header (02 00 93 00 00 00  00 1C)
  12   MAC addresses (aa aa aa aa aa aa mm mm mm mm mm mm)
  2    Length (00 83)
  8    LLC/SNAP (AA AA 03 00 00 00 88 8E)
  2    ?                  (01 03)
  2    Length             (00 77)
  1    Descriptor Type    (FE)
  2    Key Information    (01 09)
  2    Key Length         (00 20)
  8    Key Replay Counter (00 00 00 00 00 00 00 01)
  32   Key Nonce          (B1 F9 1C 00 66 00 55 8F 42 F7 07 F4 00 01 10 01 01 27 40 00 00 00 00 00 7F 06 9C 6C FF 2F B6 C7)
  16   EAPOL Key IV       (00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00)
  8    Key RSC            (00 00 00 00 00 00 00 00)
  8    Reserved           (00 00 00 00 00 00 00 00)
  16   Key MIC            (1B 1E 61 E7 C3 1F CF 0D 88 9F 7B E9 27 4B 80 AA)
  2    Key Data Length    (00 18)
  24   Key Data           (DD 16 00 50 F2 01 01 00 00 50 F2 02 01 00 00 50 F2 02 01 00 00 50 F2 02)
---------------------------------------------------------------------------------------------------------
WPA Data #3 read
  8    WMI header (02 02 A1 00 0C F4  3B 00)
  12   MAC addresses (mm mm mm mm mm mm aa aa aa aa aa aa)
  2    Length (00 85)
  8    LLC/SNAP (AA AA 03 00 00 00 88 8E)
  2    ?  01 03
  2    Length (00 79)
  1    Descriptor Type    (FE)
  2    Key Information    (01 C9)
  2    Key Length         (00 20)
  8    Key Replay Counter (00 00 00 00 00 00 00 02)
  32   Key Nonce          (0A E4 4D E8 8F 91 BA DA 89 73 78 7E 46 AF 28 97 9E C7 97 80 A7 20 4B 53 71 F6 27 F7 62 A7 B4 D9)  ;<-- same as in #1
  16   EAPOL Key IV       (00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00)
  8    Key RSC            (00 00 00 00 00 00 00 00)
  8    Reserved           (00 00 00 00 00 00 00 00)
  16   Key MIC            (30 7A 4F 98 41 29 D5 BF 43 04 58 74 E2 3E 8E 10)
  2    Key Data Length    (00 1A)
  26   Key Data           (DD 18 00 50 F2 01 01 00 00 50 F2 02 01 00 00 50 F2 02 01 00 00 50 F2 02 00 00)
  4    WMI handshake (01 02 02 01)
  8    WMI handshake (02 06 00 14 00 0A 00 00)
---------------------------------------------------------------------------------------------------------
WPA Data #4 write
  8    WMI header (02 00 7B 00 00 00  00 1C)
  12   MAC addresses (aa aa aa aa aa aa mm mm mm mm mm mm)
  2    Length (00 6B)
  8    LLC/SNAP (AA AA 03 00 00 00 88 8E)
  2    ?  01 03
  2    Length (00 5F)
  1    Descriptor Type    (FE)
  2    Key Information    (01 09)
  2    Key Length         (00 20)
  8    Key Replay Counter (00 00 00 00 00 00 00 02)
  32   Key Nonce          (00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00)
  16   EAPOL Key IV       (00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00)
  8    Key RSC            (00 00 00 00 00 00 00 00)
  8    Reserved           (00 00 00 00 00 00 00 00)
  16   Key MIC            (95 53 EE 13 CE 18 28 7C 50 87 C1 78 54 67 E4 B7)
  2    Key Data Length    (00 00)
---------------------------------------------------------------------------------------------------------
WPA Data #7 read (this NOT for WPA2 !!!)
  8    WMI header (02 02 A3 00 08 F4  3B 00)
  12   MAC addresses (mm mm mm mm mm mm aa aa aa aa aa aa)
  2    Length (00 8B)
  8    LLC/SNAP (AA AA 03 00 00 00 88 8E)
  2    ?  01 03
  2    Length (00 7F)
  1    Descriptor Type    (FE)
  2    Key Information    (03 A1)
  2    Key Length         (00 20)
  8    Key Replay Counter (00 00 00 00 00 00 00 03)
  32   Key Nonce          (0A E4 4D E8 8F 91 BA DA 89 73 78 7E 46 AF 28 97 9E C7 97 80 A7 20 4B 53 71 F6 27 F7 62 A7 B4 D8)
  16   EAPOL Key IV       (9E C7 97 80 A7 20 4B 53 71 F6 27 F7 62 A7 B4 DA)
  8    Key RSC            (00 00 00 00 00 00 00 00)
  8    Reserved           (00 00 00 00 00 00 00 00)
  16   Key MIC            (8B 0D 67 18 1E B2 81 48 02 9D 84 6A 0B DC 03 48)
  2    Key Data Length    (00 20)
  26   Key Data           (04 4C 38 D8 37 85 D8 75 D2 C7 AD 15 F9 F8 32 78 96 BE 01 97 0C 5F 9F A9 6E B6 9C 5B 3C 3C 5B 16)
  8    WMI handshake (02 06 00 DB 2A 92 8A 00)
---------------------------------------------------------------------------------------------------------
WPA Data #10 write (this NOT for WPA2 !!!)
  8    WMI header (02 00 7B 00 00 00  00 1C)
  12   MAC addresses (aa aa aa aa aa aa mm mm mm mm mm mm)
  2    Length (00 6B)
  8    LLC/SNAP (AA AA 03 00 00 00 88 8E)
  2    ?  01 03
  2    Length (00 5F)
  1    Descriptor Type    (FE)
  2    Key Information    (03 21)
  2    Key Length         (00 20)
  8    Key Replay Counter (00 00 00 00 00 00 00 03)
  32   Key Nonce          (00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00)
  16   EAPOL Key IV       (00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00)
  8    Key RSC            (00 00 00 00 00 00 00 00)
  8    Reserved           (00 00 00 00 00 00 00 00)
  16   Key MIC            (70 A2 B7 B0 78 07 D3 67 C8 1B C9 ED 4B 55 20 E1)
  2    Key Data Length    (00 00)
---------------------------------------------------------------------------------------------------------

  1st byte - Should be DDh - that's true for WPA log, but not so for WPA2 log
  2nd byte - Should be Length - that's true
  3rd-5th byte - Should be OUI value 00-0F-AC - that's wrong (WPA has 00-50-F2 in there, and WPA2 does have 00-0F-AC, but that's in 5th-7th byte)
  6th byte - Should be a cipher suite, whatever why one would need that value
  7th-last byte - Should be whatver/unspecified (in practice it's just repeating the above whatever OUI stuff)

MBOX Send Header/Body
  00h 1    Type        (00h=BootInfo, 01h=WMI Command, 02h=Data Packet)
  01h 1    Request Ack (00h=No, 01h=Yes)
  02h 2    Length of entries [06h..end]  (LEN)
  04h 2    ?
  06h LEN  Body (BootInfo/Event/Data)
  ..  ..   Padding to 80h-byte boundary (for SDIO block size 80h)
Send Body for BootInfo:
  06h ..   related to BE/BK/VI/VO stuff (best effort, background, video, voice)
Send Body for WMI Commands:
  06h 2  WMI Command Number
  08h .. Parameters
Send Body for Data Packets:
  06h 2  <Unknown6>?? 0000h or 1C00h    ;maybe whatever ?
  08h 6  Destination (MAC Addr of Router) (or FF:FF:FF:FF:FF:FF=Broadcast)
  0Eh 6  Source      (MAC Addr of DSi console)
  14h 2  Length Data at [16h...]  ;(LEN1-10h)   ;<-- BIG-ENDIAN !!!
  16h .. Data (usually starting with LLC stuff, ie. AAh,AAh,03h,00h...)
Send Body for empty Data Packets (used when changing WPA/WPA2 CIPHER keys):
  06h 1  Garbage (usually LSB of a previously used WMI command number)
  07h 1  Unknown (02h)

MBOX Receive Header/Body
  00h      1    Type        (00h=Ack only, 01h=WMI Event, 02h=Data Packet)
  01h      1    Ack Present (00h=No, 02h=Yes)
  02h      2    Length of entries [06h..end]     (LEN1+LEN2)
  04h      1    Length of Ack at [06h+LEN1..end] (LEN2) ;garbage when [01h]=00h
  05h      1    ? (00h,20h?,7Fh,F4h,FFh)
  06h      LEN1 Body (Event/Data)
  06h+LEN1 LEN2 Ack List
  ..       ..   Padding to 80h-byte boundary (for SDIO block size 80h)
Receive Body for Ack only:
  06h -  N/A (or boot request info; occurs only shortly after BMI)
Receive Body for Events:
  06h 2  WMI Event Number
  08h .. Parameters
Receive Body for Data Packets:
  06h 1  RSSI (Received Signal Strength Indicator) (00h..3Ch) (aka 0..60)
  07h 1  <Unknown7> 00h
  08h 6  Destination (MAC Addr of DSi console) (or FF:FF:FF:FF:FF:FF=Broadcast)
  0Eh 6  Source      (MAC Addr of Router)
  14h 2  Length of Data entries at [16h..(end-xtracrap)]   ;<-- BIG-ENDIAN !!!
  16h .. Data (usually LLC stuff, ie. AAh,AAh,03h.. or, once F0h,F0h,03h..??)
Ack List (can contain multiple List items):
  X+00h  List Item Type (01h=Ack, 02h=Lookahead)
  X+01h  List Item Len (02h*N for Ack's, 06h for Lookahead)
  X+02h  List Item data
Ack Items (can contain multiple Ack items):
  Y+00h  Ack Item Type (01h=Command Ack, 02h=Data Ack, 05h=Data Ack, too?)
  Y+01h  Ack Item Count? (usually 1) (or 2 for double-ack?)
Lookahead Item (if valid: allows to omit reading Func[1:00408h]):
  Z+00h  Lookahead valid ID1 (00h=No, 55h=Valid)
  Z+01h  Lookahead MBOX0 (or garbage if ID1/ID2 not valid)
  Z+05h  Lookahead valid ID2 (00h=No, AAh=Valid)

Wifi WPA/WPA2 Handshake Messages (EAPOL)
----------------------------------------

4-Way Handshake and Group Key Handshake messages
For WPA, the Group Key Handshake occurs immediately after the 4-way Handshake
(effecitively making it a 6-way handshake). For WPA2, the Group Key is
contained in the 4-way Handshake, so the Group Key Handshake isn't needed.
For both WPA and WPA2, the access point may change the Group Key every once and
then, and invoke a new Group Key Handshake for the new key.

EAPOL Key Frame
This is preceeded by a LLC/SNAP header (AAh,AAh,03h,00h,00h,00h,88h,8Eh), the
888Eh in last two bytes indicates that following bytes to contain an EAPOL Key
Frame:
  00h  2    Version/Type (or Type/Version?) (01 03)
  02h  2    Length of [04h..end] (005Fh+LEN)                      ;BIG-ENDIAN
  04h  1    Descriptor Type (FEh=WPA, 02h=WPA2)
  05h  2    Key Information (flags, see below)                    ;BIG-ENDIAN
  07h  2    Key Length (0=None, 20h=TKIP, 10h=CCMP, 05h/0Dh=WEP)  ;BIG-ENDIAN
  09h  8    Key Replay Counter (usually 0 or 1 in first message)  ;BIG-ENDIAN
  11h  32   Key Nonce (ANonce/SNonce)
  31h  16   Key Data IV (RC4 uses IV+KEK) (not used for AES-Key-Wrap)
  41h  8    Key RSC (TSC/PN) (whatever, for GTK)               ;LITTLE-ENDIAN
  49h  8    Reserved (zerofilled)
  51h  16   Key MIC on [00h..end] (with MIC initially zerofilled)       ;HMAC
  61h  2    Key Data Length (LEN) (00 nn)                         ;BIG-ENDIAN
  63h  LEN  Key Data (can be encrypted in certain messages)

Key Information flags
  0-2   Key Descriptor Version (0=WPA/MD5/RC4, 1=WPA2/SHA1/AESkeywrap)
  3     Key Type (0=Group, 1=Pairwise)
  4-5   Reserved (0) or WPA Group Key Index (1 or 2)
  6     Install  (0=No, 1=Yes, configure temporal key)
  7     Key Ack  (0=No, 1=Yes, AP wants a reply; with same Key Replay Counter)
  8     Key MIC  (0=No, 1=Yes, key frame contains MIC)
  9     Secure   (0=No, 1=Yes, initial key-exchange complete)
  10    Error    (0=No, 1=Yes, MIC failure and Request=1)
  11    Request  (0=No, 1=Yes, request AP to invoke a new handshake)
  12    Encrypted(0=No, 1=Yes, Key Data is encrypted; via RC4 or AESkeywrap)
  13-15 Reserved (0)

Key Data
Key Data does usually consist of element(s) in following form:
  00h 1   Element ID (for WPA: DDh=RSNIE - for WPA2: 30h=RSNIE, DDh=KDE)
  01h 1   Element Length of [02h..end]
  02h ..  Element Data (OUI's etc.)
WPA and WPA2 assign different meanings to Element ID value DDh. The 3-byte
maker prefix in OUI values does also differ for WPA/WPA2. And, the meaning of
the OUI's varies depending on WHERE they are used (eg. 00-0F-AC-02 could be a
Cipher Suite entry, or an Authentication entry):
  EAPOL Descriptor Type values
  WPA          WPA2         Meaning
  FEh          02h          Indicates if ElementIDs and OUIs are WPA or WPA2
  EAPOL Key Information flags/values
  0089h        008Ah        Handshake #1  ;\
  0109h        010Ah        Handshake #2  ; 4-way Handshake
  01C9h        13CAh        Handshake #3  ;
  0109h(again) 030Ah        Handshake #4  ;/
  0391h/03A1h  1382h        Handshake #5  ;\Group Key Handshake
  0311h/0321h  0302h        Handshake #6  ;/
  EAPOL Key Data Element IDs
  DDh          30h          Element ID for RSNIE (Robust Network Security info)
  -            DDh          Element ID for KDE (Key Data Encapsulation)
  -            DDh          Element ID for padding (followed by 00h-bytes)
  RSNIE Version Prefix OUI's (WPA only):
  00-50-F2-01  -            RSNIE Version Prefix (followed by 2 bytes?)
  RSNIE Group Cipher suite selector OUI's (aka Multicast):
  00-50-F2-01  00-0F-AC-01  RSNIE Group Cipher WEP-40  (default for US/NSA)
  00-50-F2-02  00-0F-AC-02  RSNIE Group Cipher TKIP    (default for WPA)
  00-50-F2-04  00-0F-AC-04  RSNIE Group Cipher CCMP    (default for WPA2)
  00-50-F2-05  00-0F-AC-05  RSNIE Group Cipher WEP-104 (default for WEP)
  RSNIE Pairwise Cipher suite selector OUI's (aka Unicast):
  00-50-F2-00  00-0F-AC-00  RSNIE Pairwise Cipher None (WEP, Group Cipher only)
  00-50-F2-02  00-0F-AC-02  RSNIE Pairwise Cipher TKIP (default for WPA)
  00-50-F2-04  00-0F-AC-04  RSNIE Pairwise Cipher CCMP (default for WPA2)
  RSNIE Authentication AKM suite selector OUI's :
  00-50-F2-01  00-0F-AC-01  RSNIE Authentication over IEEE 802.1X
  00-50-F2-02  00-0F-AC-02  RSNIE Authentication over PSK
  KDE Key Data Encapsulation OUI's (WPA2 only):
  -            00-0F-AC-01  KDE GTK         (followed by 2+N bytes)
  -            00-0F-AC-02  KDE STAKey      (followed by 2+6+N bytes)
  -            00-0F-AC-03  KDE MAC address (followed by 6 bytes)
  -            00-0F-AC-04  KDE PMKID       (followed by 16 bytes)

RSNIE (Robust Network Security Information Element)
RSNIE allows to exchange information about the desired/supported encryption
methods. RSNIE is found in handshake message 2/3 (and also in Beacons). In most
cases one could just ignore the RSNIE stuff (eg. if Wifi FLASH is already
configured to use a specific cipher type). A special case might be networks
that use a weaker Group Cipher (for older devices) combined with offering
stronger Pairwise Ciphers (for devices that support them).
  WPA2 RSNIE (Robust Network Security Information Element):
  00h  1  Element ID (30h=RSNIE for WPA2)
  01h  1  Element Len of [02h..end] (usually 14h)
  02h  2  RSNIE Version 1                        (01 00)     ;WHATEVER-ENDIAN?
  04h  4  RSNIE Group Cipher Suite OUI (CCMP)    (00 0F AC 04)
  08h  2  RSNIE Pairwise Cipher Suite Count (1)  (01 00) (in  ;LITTLE-ENDIAN
  0Ah  4  RSNIE Pairwise Cipher Suite OUI (CCMP) (00 0F AC 04)
  0Eh  2  RSNIE Authentication Count (1)         (01 00)      ;LITTLE-ENDIAN
  10h  4  RSNIE Authentication OUI (PSK)         (00 0F AC 02)
  14h  2  RSNIE Capabilities                     (00 00)      ;LITTLE-ENDIAN?
  16h (2) RSNIE Optional PMKID Count  ;\usually none such     ;LITTLE-ENDIAN
  18h (16)RSNIE Optional PMKID's      ;/
  WPA RSNIE (Robust Network Security Information Element):
  00h  1  Element ID (DDh=RSNIE for WPA)
  01h  1  Element Len of [02h..end] (usually 16h or 18h)
  02h  4  RSNIE Version OUI (version)   (00 50 F2 01)       ;<-- WPA only
  06h  2  RSNIE Version value? (1)      (01 00)              ;WHATEVER-ENDIAN?
  08h  4  RSNIE Mcast OUI (TKIP)        (00 50 F2 02)
  0Ch  2  RSNIE Ucast Count (1)         (01 00)               ;LITTLE-ENDIAN
  0Eh  4  RSNIE Ucast OUI (TKIP)        (00 50 F2 02)
  12h  2  RSNIE Auth AKM Count (1)      (01 00)               ;LITTLE-ENDIAN
  14h  4  RSNIE Auth AKM OUI (PSK)      (00 50 F2 02)
  18h (2) RSNIE Capabilities maybe?     (00 00)               ;LITTLE-ENDIAN?
  RSN Capabilities flags (usually 0000h) (also spotted: 0C 00):
  0   RSN Pre-Auth capabilities
  1   RSN No Pairwise capabilities
  2-3 RSN PTKSA Replay Counters (0..3 = 1,2,4,16 replay counters)
  4-5 RSN GTKSA Replay Counters (0..3 = 1,2,4,16 replay counters)
  6   Managment Frame Protection Required
  7   Managment Frame Protection Capable
  8   Joint Multi-band RSNA
  9   PeerKey Enabled
  10  SPP A-MSDU Capable
  11  SPP A-MSDU Required
  12  PBAC
  13  Ext Key ID for Unicast
  14-15 Reserved (0)

KDE Key Data Encapsulation (or raw data for WPA)
KDE (or WPA's raw data) is mainly useful for transferring the GTK group key.
Note that Key Data in WPA2 message 3 contains both RSNIE and KDE GTK (and KDE
padding). Whilst the raw data in WPA cannot be mixed RSNIE.
  WPA2 KDE GTK (Key Data Encapsulation for Group Key, in encrypted Key Data):
  00h  1   Element ID (DDh=KDE for WPA2)
  01h  1   Element Len (16h)
  02h  4   KDE OUI GTK (00-0F-AC-01) (occurs in message 3/5)
  06h  1   KDE GTK Key ID (01h or 02h)      ;bit2: Tx ?
  07h  1   KDE GTK Reserved (00h)
  08h  16  KDE GTK Key GTK (for Key ID from above byte [06h])
  WPA2 KDE PKMID (Key Data Encapsulation for PKMID) (optional, not needed):
  00h  1   Element ID (DDh=KDE for WPA2)
  01h  1   Element Len (14h)
  02h  4   KDE OUI PMKID (00-0F-AC-04) (optionally occurs in message 1)
  06h  16  KDE PMKID (useless checksum on PMK, sometimes exposed in message 1)
  WPA2 KDE Padding (for padding Key Data to Nx8 bytes for AES-Key-wrap):
  00h  1   Element ID (DDh=KDE for WPA2)
  01h  0-6 Padding (00h) (aka Element Len=00h)
  WPA GTK (raw Group Key; without Element ID or KDE-style encapsulation):
  00h  16  Key GTK (for Key ID from Key Information bit4-5) (in message 5)

Connection data 4 at WifiFlash[00020h]*8-A00h (eg. 01F400h) (DSi only)
Connection data 5 at WifiFlash[00020h]*8-800h (eg. 01F600h) (DSi only)
Connection data 6 at WifiFlash[00020h]*8-600h (eg. 01F800h) (DSi only)
The DSi has three extra 200h-byte regions (for use DSi games, with the new
WPA/WPA2 encryption support, and with additional proxy support), these extra
regions are found under "Advanced Setup" in the DSi firmware's "Internet"
configuration menu.
  Addr Siz Expl.
  000h 32  Proxy Authentication Username (ASCII string, padded with 00's)
  000h 32  Proxy Authentication Password (ASCII string, padded with 00's)
  040h 32  SSID (ASCII string, padded with 00's) (see [0E8h] for length)
  060h ..  Maybe same as NDS
  080h ..  WEP Key (zerofilled for WPA)
  0xxh ..  Maybe same as NDS
  0C0h 4   IP Address           (0=Auto/DHCP)
  0C4h 4   Gateway              (0=Auto/DHCP)
  0C8h 4   Primary DNS Server   (0=Auto/DHCP)
  0CCh 4   Secondary DNS Server (0=Auto/DHCP)
  0D0h 1   Subnet Mask (0=Auto/DHCP, 1..1Ch=Leading Ones) (eg. 6 = FC.00.00.00)
  0D1h ..  Unknown (zerofilled)
  0E6h 1   WEP (00h=None/WPA/WPA2, 01h/02h/03h/05h/06h/07h=WEP, same as NDS)
  0E7h 1   WPA (00h=Normal, 10h=WPA/WPA2, or FFh=unused/deleted)
  0E8h 1   SSID Length in characters (01h..20h, or 00h=unused)
  0E9h 1   Unknown (usually 00h)
  0EAh 2   MTU Value (Max transmission unit) (576..1500, usually 1400)
  0ECh 3   Unknown (usually 00h-filled)
  0EFh 1   bit0/1/2 - connection 4/5/6 (1=Configured, 0=Not configured)
  0F0h 14  Zerofilled (or maybe ID as on NDS, if any such ID exists for DSi?)
  0FEh 2   CRC16 for Entries 000h..0FDh (with initial value 0000h)
  100h 32  Precomputed PSK (based on WPA/WPA2 password and SSID) ;\all zero
  120h 64  WPA/WPA2 password (ASCII string, padded with 00's)    ;/for WEP
  160h 33  Zerofilled
  181h 1   WPA (0=None/WEP, 4=WPA-TKIP, 5=WPA2-TKIP, 6=WPA-AES, 7=WPA2-AES)
  182h 1   Proxy Enable         (00h=None, 01h=Yes)
  183h 1   Proxy Authentication (00h=None, 01h=Yes)
  184h 48  Proxy Name (ASCII string, max 47 chars, padded with 00's)
  1B4h 52  Zerofilled
  1E8h 2   Proxy Port (16bit)
  1EAh 20  Zerofilled
  1FEh 2   CRC16 for Entries 100h..1FDh (with initial value 0000h) (0=deleted)
The location of the first data block (aka settings number 4) is at the User
Settings address minus A00h, ie. Firmware Header [00020h]*8-A00h.
Observe that NDS consoles do have Firmware bootcode/data in that area, so those
new regions exist on DSi only. Presence of the new regions is indicated in
Firmware Header [001FEh], that byte is usually FFh=NDS or 20h=DSi, the DSi
browser does internally replace FFh by 10h, and does then check if byte>=20h
(ie. the new areas exist if the byte is 20h..FEh).

Nocash Wifiboot v2.4
Connecting

Offset       WPS   Normal
1F6E7        13    10         ;<-- diff
1F6FE        F4    A0         ;\crc
1F6FF        9D    78         ;/
1F734-1F75E  xxx   00-filled  ;-garbage (unused password chars)
1F7FE        F3    49         ;\crc
1F7FF        2C    1B         ;/

;wifiboot v2.5 - 26 Jan 2019
; - dsi-wifi: detects supported cipher/combinations (from AP beacons)
; - dsi-wifi: determines best-matching-cipher (AP beacons versus FLASH settings)
; - dsi-wifi: supports wifi-flash entries with WPS-flag (ie. ignores that flag)
; - dsi-wifi: relocated all code to vram (slightly faster than slow main ram)
; - dsi-wifi: displays life-updates for current signal strength
; - dsi-wifi: source code: REG_SDIO_xxx symbols instead of numeric I/O addresses
; - dsi-wifi: uses WMI_GET_CHANNEL_LIST to determine enabled channels/domain
; - dsi-wifi: shows REG_DOMAIN country code (eg. 0188=JP, 0348=US)

08 Feb 2019 - version 2.9c
- wifiboot: now supports dsi-wifi-hardware with wpa/wpa2 encryption
- utility/upload: omits nocashio lpt-port-driver for wifi upload (thanx edo9300)
- dsi/wifi/hack: dsi browser patch for writing all sdio traffic to wifi-log.txt
- dsi/wifi/help: new chapter for DSi Atheros Wifi - MBOX Transfer Headers
- dsi/wifi/help: added notes on used WMI params (connect, cipher, pstream, etc)
- dsi/wifi/help: more details for access point 4/5/6 settings in wifi-flash
- nds/wifi/help: updated ds download play chapter (and separate beacon chapter)
- nds/wifi/help: new chapters for WPA/WPA2: handshake, keys/mics, encryption
- nds/help: added reverse-engineered dldi specs (flashcart driver for homebrew)
- dsi/help: added several notes on files found in firmware v1.0J (thanks AnKi)
- dsi/ndma: added support for SDIO startup mode (much alike as SDMMC startup)
- dsi/boot: init AES Key2.X (for Data Managment export to SD card, thanx zoogie)
- dsi/help: device list: details on naming for "public & private savedata"
- dsi/autoload/help: new chapter for auto-loading (formerly in i2c chapter)
- dsi/autoload/help: added skeleton/info on 2000000h (autoload parameters)
- dsi/autoload/help: added more details on 2000300h (autoload by title id)
- dsi/autoload/help: added specs for 2000800h (unlaunch autoload by path\name)
- dsi/autoload/help: added specs for 2FFD800h (nintendo's title list and flags)
- dma/gba/nds7: re-fixed dma0/1/2 len, don't crop 16bit to 8bit (thanx normmatt)
- dsi/bios: added warn if/when using missing RSA keys (missing bios dsi dump)
- aboutbox: added email/contact page (debug version only, not gaming version)
- xed editor: fixed scrolling upon backspace in first some lines (thanks yuki)

DSi "5A32" chip (32Kit aka 4Kbyte)
Early DSi DWM-W015 boards did have 128Kbyte FLASH, but later boards have custum
4Kbyte FLASH chips (these 4K chips are found on later DSi DWM-W015 boards, and
DSi DWM-W024 boards, and 3DS DWM-W028 boards). The chips are having a 24bit
address bus (needed for NDS compatibility), and, a weird non-writeable gap
within a 128Kbyte memory are:
  000000h..0002FFh  Writeable only if /WP=HIGH (otherwise writes are ignored)
  000300h..01F2FFh  Not writeable (FFh-filled, writes are ignored)
  01F300h..01FFFFh  Writeable
  020000h and up    Mirrors of 0..01FFFFh (same read/write-ability as above)
There are several part numbers: "5A32" (DSi), "5K32" (3DS), "32B, 3XH" (3DS),
and "26FV032T" (DSi), that chips are probably all the same size & functionally
same; most of those 4Kbyte chips have tiny packages (except "26FV032T" which
comes in classic large package).

Pin-Outs (Large Package, in NDS, and early DSi boards)
  1   D    Serial Data In (latched at rising clock edge)          _________
  2   C    Serial Clock (max 25MHz)                             /|o        |
  3   /RES Reset                                            1 -| |         |- 8
  4   /S   Chip Select (instructions start at falling edge) 2 -| |         |- 7
  5   /W   Write Protect (makes first 256 pages read-only)  3 -| |_________|- 6
  6   VCC  Supply (2.7V..3.6V typ) (4V max) (DS:VDD3.3)     4 -|/          |- 5
  7   VSS  Ground                                              |___________|
  8   Q    Serial Data Out (changes at falling clock edge)

Pin-Outs (Tiny Package, in newer DSi boards, and 3DS)
  1   /S   Chip Select (instructions start at falling edge)     ___________
  2   Q    Serial Data Out (changes at falling clock edge)  1 -| o         |- 8
  3   /W   Write Protect (makes first pages read-only)      2 -|           |- 7
  4   VSS  Ground                                           3 -|           |- 6
  5   D    Serial Data In (latched at rising clock edge)    4 -|___________|- 5
  6   C    Serial Clock
  7   /RES Reset
  8   VCC  Supply (2.7V..3.6V typ) (DSi: VDD33)

Wifi FCC ID
The wifi hardware has been registered by Mitsume, Hon Hai, and Nintendo
themselves:
  https://fccid.io/BKE - Nintendo
  https://fccid.io/EW4 - Mitsumi
  https://fccid.io/MCL - Hon Hai (Foxconn)
The above webpages include some unrelated stuff (like bluetooth), and some
duplicate entries. The wifi/console related entries are:
  https://fccid.io/EW4-AGBWA      GBA        ;\GBA wireless adaptor
  https://fccid.io/EW4-OXYWA      GBA-Micro  ;/(not wifi/wlan compatible)
  https://fccid.io/BKENTR001      NDS (non-remove-able board)
  https://fccid.io/BKEUSG-001     NDS-Lite (old remove-able board, with MM3155)
  https://fccid.io/EW4DWMW006     NDS-Lite (new remove-able board, with MM3218)
  https://fccid.io/BKERVL036      Wii
  https://fccid.io/EW4DWMW004     Wii (mitsumi) (also W016, and maybe W014 ?)
  https://fccid.io/MCLJ27H010     Wii (foxconn) (also H003 ?)
  https://fccid.io/EW4DWMW015     DSi (old wifi board, mitsumi)
  https://fccid.io/EW4DWMW024     DSi (new wifi board, mitsumi)
  https://fccid.io/MCLJ27H020     DSi (new wifi board, foxconn)
  https://fccid.io/EW4DWMW028     3DS (mitsumi)
  https://fccid.io/MCLJ27H023     3DS (foxconn)
  https://fccid.io/MCLJ27H02301   2DS (foxconn)
  https://fccid.io/BKERED001      New3DS (on mainboard)
The pages include test reports, photos (including some prototypes), and most
interestingly, the Mitsumi "Label location" pages usually include pinout &
signal names for the wifi board.

DSi Wifi board pinout
https://fccid.io/EW4DWMW024/Label/Label-format-and-location-1137926.pdf
https://fccid.io/EW4DWMW015/Label/Label-Location-1031953.pdf
  1  MX_SD_CLK    2  GND
  3  GND          4  VDD_18
  5  SDIO_DATA0   6  VDD_18
  7  SDIO_DATA3   8  GND
  9  SDIO_DATA1   10 VDD_33
  11 SDIO_CMD     12 VDD_33
  13 SDIO_DATA2   14 GND
  15 JTAG_TDO     16 ATH_TX_H
  17 JTAG_TMS     18 SYS_RST_L
  19 GND          20 JTAG_TDI
  21 CLK32k       22 JTAG_TCK
  23 GND          24 JTAG_TRST_L
  25 NC(VDD28_TP) 26 SEL_ATH_L
  27 SPI_CS2      28 W_B
  29 BBP_SLEEP    30 SPI_CLK
  31 RF_SLEEP     32 SPI_DO   MISO
  33 RF_SCS       34 SPI_DI   MOSI
  35 BPP_SCS      36 CCA        ;typo: should be BBP (not BPP)
  37 BB_RF_SDO    38 RXPE
  39 BB_RF_SDI    40 TRDATA
  41 BB_RF_SCLK   42 GND
  43 NC(VDD18_TP) 44 TRCLK
  45 GND          46 TRRDY
  47 MCLK         48 TXPE
  49 GND          50 RESET

DS-Lite Wifi board DWM-W006 pinout
https://fccid.io/EW4DWMW006/Label/ID-label-format-and-location-706511.pdf
  1  GND          16 +3.3V
  2  TXPE         17 GND
  3  RXPE         18 RF_SCS
  4  CCA          19 BBP_SLEEP
  5  TRRDY        20 BBP_SCS
  6  GND          21 RF_SLEEP
  7  TRCLK        22 RESET
  8  TRDATA       23 GND
  9  GND          24 SPI_CLK
  10 BB_RF_SDO    25 SPI_DI
  11 BB_RF_SDI    26 SPI_DO
  12 BB_RF_SCLK   27 W_B
  13 GND          28 SIP_CS2     ;typo: should be SPI (not SIP)
  14 MCLK         29 LD
  15 GND          30 GND

Wii Wifi board
https://fccid.io/EW4DWMW004/Label/ID-Label-670426.pdf
  1  GND          12 VDD3.3
  2  SDIO_DATA_2  13 GND
  3  SDIO_DATA_1  14 GPIO_0
  4  GND          15 GND
  5  SDIO_CLK     16 SDIO_DATA_3
  6  GND          17 SDIO_DATA_0
  7  GPIO_1       18 GND
  8  GND          19 SDIO_CMD
  9  N.C.(VDD1.8) 20 GND
  10 N.C.(VDD1.8) 21 ANT_A (MAIN)
  11 VDD3.3       22 ANT_B (AUX)

3DS Wifi Board DWM-W028
https://fccid.io/EW4DWMW028/Label/ID-label-location-1272988.pdf
  1  MCLK         2  RF_CSRF
  3  GND          4  BB_CSBB
  5  RXPE         6  BB_RF_SDIN
  7  TXPE         8  BB_RF_SDOUT
  9  CCA          10 BB_RF_SCK
  11 TRDATA       12 GND
  13 TRCLK        14 BBP_SLEEP_L
  15 TRRDY        16 RF_SLEEP_L
  17 TRST_L       18 SEL_ATH_L
  19 GND          20 GND
  21 SDIO_DATA_0  22 JTAG_TDO
  23 SDIO_DATA_1  24 JTAG_TMS
  25 SDIO_DATA_2  26 JTAG_TDI
  27 SDIO_DATA_3  28 JTAG_TCK
  29 GND          30 SPI_CS2
  31 SDIO_CLK     32 W_B
  33 GND          34 SPI_CLK
  35 SDIO_CMD     36 SPI_DO
  37 UART_TXD     38 SPI_DI
  39 UART_RXD     40 SYS_RST_L
  41 GND          42 ATH_TX_H
  43 CLK32k       44 RESET
  45 GND          46 GND
  47 VDD_18       48 VDD_33
  49 VDD_18       50 VDD_33
Functionally same as DSi, but not pin-compatible, and with two UART pins
(instead of the NC pins).

  0047h  WMI_SET_FRAMERATES_CMD    ;aka WMI_FRAME_RATES_CMD
  0048h  WMI_SET_AP_PS_CMD         ;aka WMI_AP_PS_CMD
  0049h  WMI_SET_QOS_SUPP_CMD

  0047h  WMI_START_WHATEVER_TIMER_CMD                        ;-whatever on DSi!
  0048h  WMI_SET_FRAMERATES_CMD    ;aka WMI_FRAME_RATES_CMD  ;-cmd 0048h on DSi (instead of 0047h)!
  0049h  WMI_HOST_EXIT_NOTIFY_CMD  ;special DSi/3DS command (called host exit notify in ar6013/6014 ascii strings)

  003Bh  WMI_SET_BT_STATUS_CMD    ;\Bluetooth Coexistence
  003Ch  WMI_SET_BT_PARAMS_CMD    ;/

Special 3DS commands (for Type4 firmware, with AP mode):
  004Ah  WMI_AP_HIDDEN_SSID_CMD                         ;01h bytes (1)
  004Bh  WMI_AP_SET_NUM_STA_CMD aka WMI_AP_NUM_STA_CMD  ;01h bytes (1)
  004Ch  WMI_AP_ACL_POLICY_CMD                          ;01h bytes (1)
  004Dh  WMI_AP_ACL_MAC_LIST_CMD aka WMI_AP_ACL_MAC_CMD ;09h bytes (1+1+6+1)
  004Eh  WMI_AP_CONFIG_COMMIT_CMD                       ;34h bytes (..)
  004Fh  WMI_AP_SET_MLME_CMD                            ;09h bytes (6+2+1)
  0050h  WMI_AP_SET_PVB_CMD     ;ignored on 3DS         ;06h bytes (ignored)
  0051h  WMI_AP_CONN_INACT_CMD                          ;04h bytes (4)
  0052h  WMI_AP_PROT_SCAN_TIME_CMD                      ;08h bytes (4+4)
  0053h  WMI_?                                      ;01h bytes (1)
  0054h  N/A
  0055h  WMI_?                                      ;04h bytes (2+2)
  0056h  WMI_ignored_?                              ;01h bytes (ignored)
  0057h  WMI_?  ;with EVENT_1022h                   ;00h bytes
  0058h  WMI_?     <-- with optional params?        ;var       (2+2+1+1+N)
  0059h  WMI_?       ;only lower 8bit used          ;04h bytes (4; only 1 used)
  005Ah  WMI_?                                      ;01h bytes (1)
  005Bh  WMI_?                                      ;04h bytes (2+1+1)
  005Ch  WMI_?                                      ;04h bytes (1+3)
  005Dh  WMI_?                                      ;0Ah bytes (1+1+2+1+1+2+2)
  005Eh  WMI_?                                      ;01h bytes (1)
  005Fh  WMI_?                                      ;04h bytes (4)
Special 3DS commands (for Type5 firmware, with MacFilter and GameID):
  0060h  WMI_?                             ;3Ah bytes
  0061h  WMI_?                             ;28h bytes
  0062h  WMI_?                             ;12h bytes
  0063h  WMI_?                             ;02h bytes
  0064h  WMI_?                             ;03h bytes
  0065h  WMI_?                             ;07h bytes
  0066h  WMI_?                             ;07h bytes
  0067h  WMI_?                             ;03h bytes
  0068h  WMI_?  ;can be with EVENT_1023h   ;01h bytes
  0069h  WMI_?                             ;00h bytes
  006Ah  WMI_?                             ;00h bytes
  006Bh  WMI_?                             ;01h bytes
  006Ch  WMI_?                             ;06h bytes
  006Dh  WMI_?  ;with EVENT_1026h          ;00h bytes
  006Eh  WMI_?                             ;01h bytes
  006Fh  WMI_?                             ;06h bytes
  0070h  WMI_?                             ;01h bytes
  0071h  WMI_?                             ;08h bytes
  0072h  WMI_?                             ;02h bytes
  0073h  WMI_?  ;with EVENT_1027h          ;01h bytes

  Stub.data   038h bytes                   ;\Database and EEPROM reading stub
  Stub.code   316h bytes                   ; (always same size/content)
  Database    1E8h bytes                   ;/
  Main.type1  0FD3h, 10F7h, or 1B1Bh bytes ;\Main firmware (compressed)
  Main.type4  A053h, A482h, or A5EBh bytes ; (size/content varies per version)
  Main.type5  78F6h, 7A2Eh, or 7A2Eh bytes ;/