Wireless driver w/packet injection support- Bounty

[gotwake424]

http://david.gnedt.eu/blog/wl1251/


The above is a link to the creator of N900 wifi driver kernel, He is willing to help us with his source code.


The author of the patches has no problem with us working with his patches but he did say in his response....


"but you should know that there may be some problems if this device uses the sdio interface instead of spi"


This has been talked about a little on the gp32x.


It would open a lot of doors not only with packet injection but other fixes that are included in his release. It could help solve the wifi and bluetooth coexistence.


http://www.gp32x.de/board/index.php?/topic/57992-wifi-patches-for-n900-w-packet-injection-on-pandora/


Notaz-


I saw those packet injection patches and they can be applied with some modification


Requirements


.Monitor mode and Packet injection patches


.bluetooth coexistence


.Bugfixes from the the N900 wifi driver


.Adhoc support


Payment for the bounty will be completed through paypal unless stated otherwise.


Bounty- 65 USD


Gotwake424- 20 USD


Xopher - 20 USD


Thann- 25 USD

 

[XxionxX]

Would this increase the wifi speeds? What would this encompass besides packet injection? What is packet injection and why should I want it?

 

[notaz]

I've just pushed out pandora-wifi.git at git.openpandora.org, it has something like half of work done for this, so anyone taking this should start from there. I recommend applying the patches that were sent to linux-wireless and testing the result.

 

[WizardStan]

Would this increase the wifi speeds? What would this encompass besides packet injection? What is packet injection and why should I want it?

Packet injection lets you inject packets.


More generally, it lets your computer with the packet injection software send a packet to another computer pretending to be a third computer that the second computer is already connected to.


Like, suppose two computers make a TCP connection, A and B. A says hello to B, B respond "hi there.". C computer running packet injection sees the unencrypted connection, and "injects" the packets "I'm a complete tool" into B's stream. As far as A can tell, B has said "hi there. I'm a complete tool" but B has no idea that this has happened.


More specifically, it's used a lot in computer security, mostly trying to break security from what I've seen, but there are a number of applications where it can be used to enhance it (and sometimes it does both).

 

[xopher]

I'm chiming in to confirm my offering to the bounty. Thanks in advance to the dev who picks up this project and thank you to Notaz to putting some of the pieces together for this.

 

[alan]

I've applied many of those patches from David Gnedt


Some results: (cleared MACs and SSIDs)


moo:/media/mmcblk1p1$ sudo aireplay-ng -9 mon0


03:12:26 Trying broadcast probe requests...


03:12:26 Injection is working!


03:12:27 Found 3 APs


03:12:27 Trying directed probe requests...


03:12:27 00:00:00:00:00:00 - channel: 1 - 'ClearedSSID1'


03:12:31 Ping (min/avg/max): 5.249ms/14.347ms/33.691ms


03:12:31 16/30: 53%


03:12:31 00:00:00:00:00:00 - channel: 1 - 'ClearedSSID2'


03:12:34 Ping (min/avg/max): 6.470ms/11.625ms/23.834ms


03:12:34 21/30: 70%


03:12:34 00:00:00:00:00:00 - channel: 1 - 'ClearedSSID3'


03:12:38 Ping (min/avg/max): 7.233ms/12.941ms/22.888ms


03:12:38 18/30: 60%


Not great percentages (whatever they mean), but it's a start!


I don't have any other packet injection capable wireless devices so I haven't been able to test Aircrack-ng injection_test


Let me know if you can test and I'll try to package up the drivers.

 

[zowki]

I've applied many of those patches from David Gnedt


Some results: (cleared MACs and SSIDs)


moo:/media/mmcblk1p1$ sudo aireplay-ng -9 mon0


03:12:26 Trying broadcast probe requests...


03:12:26 Injection is working!


03:12:27 Found 3 APs


03:12:27 Trying directed probe requests...


03:12:27 00:00:00:00:00:00 - channel: 1 - 'ClearedSSID1'


03:12:31 Ping (min/avg/max): 5.249ms/14.347ms/33.691ms


03:12:31 16/30: 53%


03:12:31 00:00:00:00:00:00 - channel: 1 - 'ClearedSSID2'


03:12:34 Ping (min/avg/max): 6.470ms/11.625ms/23.834ms


03:12:34 21/30: 70%


03:12:34 00:00:00:00:00:00 - channel: 1 - 'ClearedSSID3'


03:12:38 Ping (min/avg/max): 7.233ms/12.941ms/22.888ms


03:12:38 18/30: 60%


Not great percentages (whatever they mean), but it's a start!


I don't have any other packet injection capable wireless devices so I haven't been able to test Aircrack-ng injection_test


Let me know if you can test and I'll try to package up the drivers.

I would like to help with testing ad hoc connectivity.

 

[gotwake424]

Great job man!


Just a few bugs to workout and I suspect this bounty is yours!

 

[maxxdoutvdub]

i have several injection capable devices and my own private networks setup for legitimate testing. if you need a tester i would like to help. maybe i could compare injection speed and quality between a pandora, a laptop with atheros chip and ath5k driver, and patched n900?

 

[gotwake424]

i have several injection capable devices and my own private networks setup for legitimate testing. if you need a tester i would like to help. maybe i could compare injection speed and quality between a pandora, a laptop with atheros chip and ath5k driver, and patched n900?

Sounds like a great idea mate. I assume you could also test the various encryption support ( wep, wpa, wpa2, etc?) too? Still waiting on my RMA otherwise I would be glad to do it

 

[Thann]

I will hit someone with $25 USD for this! and if the wifi gets a bit faster I would not complain either =)


but seriously some injection would be awesome.

 

[gotwake424]

I will hit someone with $25 USD for this! and if the wifi gets a bit faster I would not complain either =)


but seriously some injection would be awesome.

Updated to include your pledge. Thanks mate

 

[pokitfoxx]

sorry im fairly noobish, what would be the end result differences? between getting this and what we have now?

 

[gotwake424]

sorry im fairly noobish, what would be the end result differences? between getting this and what we have now?

Well besides the things listed in the requirments.


Packet injection allows you to do many different things. Such as wep penatration testing. Looking at traffic going through a network and other things. You really should just google packet injection

 

[maxxdoutvdub]

i have several injection capable devices and my own private networks setup for legitimate testing. if you need a tester i would like to help. maybe i could compare injection speed and quality between a pandora, a laptop with atheros chip and ath5k driver, and patched n900?

Sounds like a great idea mate. I assume you could also test the various encryption support ( wep, wpa, wpa2, etc?) too? Still waiting on my RMA otherwise I would be glad to do it

sure thing, ill cover all the basics with the testing. also if anyone has suggestions for more complex tests we can run through those too.


im gonna play around with a bt5 chroot later, i already have it running on my n900 so it should be easy on the pandora. this driver will just be icing on the cake.

 

[gotwake424]

i have several injection capable devices and my own private networks setup for legitimate testing. if you need a tester i would like to help. maybe i could compare injection speed and quality between a pandora, a laptop with atheros chip and ath5k driver, and patched n900?

Sounds like a great idea mate. I assume you could also test the various encryption support ( wep, wpa, wpa2, etc?) too? Still waiting on my RMA otherwise I would be glad to do it

sure thing, ill cover all the basics with the testing. also if anyone has suggestions for more complex tests we can run through those too.


im gonna play around with a bt5 chroot later, i already have it running on my n900 so it should be easy on the pandora. this driver will just be icing on the cake.

Can you do some "deep" packet injection like monitoring network traffic? Idk if you'd need a program ported for that like wireshark

 

[maxxdoutvdub]

we already have wireshark, its in the angstrom repo i believe ;-) with the most current patched driver we can already sniff network traffic which i can confirm working. i also have aircrack suite from the repo's. first order of business will be ARP replay against 64 bit wep ap as a simple starter test. i guess run it a couple times vs the n900, compare overall time until keys are recovered. n900 probably a good basis for comparison as they are similar devices.


we should probably test up/down speed and bluetooth coexistance for improvement. restest ad/hoc as well. couldnt hurt to be thorough.

 

[gotwake424]

well to get the bounty he has to meet all the requirements.


Sounds good Maxx!


The Bluetooth coexistence is a big one for a lot of people I would suspect.

 

[maxxdoutvdub]

any luck alan?

 

[alan]

sorry for the delay, think it kind of works, no luck testing chopchop or fragmentation


looky here


UPDATE: cleaner patch here


EDIT: I wrote none of these patches! It just some of David Gnedt's http://david.gnedt.eu/blog/wl1251/ brilliant patches and a couple of extra missing patches to make it work. I'll dig out the links if anyone is interested