WiFi monitor mode

cerg2010cerg2010 · Jun 11, 2013 19 65 0

OK, I don't think this thread will get any attention, but I want to document it anyway. All this should work on other devices with qcom WiFi drivers.

TL;DR:
Grab iwpriv binary somewhere (i've got my here: https://github.com/kriswebdev/android_wireless_tools/tree/master/bin)
adb push iwpriv /data/local/tmp/
adb shell su -c chmod +x /data/local/tmp/iwpriv

Code:

#!/system/bin/sh
ip link set wlan0 down
sleep 1
echo 4 > /sys/module/wlan/parameters/con_mode
sleep 2
ip link set wlan0 up
/data/local/tmp/iwpriv wlan0 monitor 1
/data/local/tmp/iwpriv wlan0 MonitorModeConf 9 40 1 111 0

And enjoy your airodump output

NO PACKET INJECTION! (stubbed out in driver, removed previously?)
If you don't receive any packets, issue "/data/local/tmp/iwpriv wlan0 monitor 1" again.

How does this all work?
Some time ago I discovered these strings in wlan_hal_msg.h: (they appeared in google):

Code:

...
   /* Monitor Mode */
   WLAN_HAL_ENABLE_MONITOR_MODE_REQ         = 302,
   WLAN_HAL_ENABLE_MONITOR_MODE_RSP         = 303,

   WLAN_HAL_DISABLE_MONITOR_MODE_REQ        = 304,
   WLAN_HAL_DISABLE_MONITOR_MODE_RSP        = 305,
...

Then I unscrambled some indirections:

And then figured out that driver works in different modes:
(vos_types.h)

Code:

/// Concurrency role.  These are generic IDs that identify the various roles
/// in the software system.
typedef enum
{ /*ON linux maintain 1-1 corespondence with device_mode_t in hdd*/
    VOS_STA_MODE=0, 
    VOS_STA_SAP_MODE=1, //to support softAp  mode . This is misleading. It means AP MODE only. 
                        //The constant name has historical reason
    VOS_P2P_CLIENT_MODE,
    VOS_P2P_GO_MODE,
    VOS_MONITOR_MODE,
    VOS_FTM_MODE = 5,
    VOS_IBSS_MODE,
    VOS_P2P_DEVICE,
    VOS_MAX_NO_OF_MODE
} tVOS_CON_MODE;

Mode can be changed by "con_mode" module parameter.
(idk why they reinvented the wheel and not used the default "iw dev wlan0 set mode monitor")

Combined all this and... got a kernel panic. You may get it too. Main reasons are:
- You have not disabled WiFi before changing the mode
- The sleep time after disabling interface is short
- Driver is old. Yes, you can get crashes on some kernels. If you are, flash AGNi.

After successful switching you'll get a working monitor (check this with tcpdump -i wlan0), but with ethernet packets instead of radiotap, so airodump will not work. Luckily, this giant crappy driver can work with radiotap, but you need to configure it. This is done by another iwpriv call:
MonitorModeConf: <channel> <bandwidth> <crccheck> <filter> <conversion_required>
Filter: 3 decimal numbers
least to most: management packets, control packets, data packets
Conversion: 1 - ARPHRD_ETHER (802.3 packets), 0 - ARPHRD_IEEE80211_RADIOTAP (802.11 packets)
(again don't know why they implemented these calls instead of default ioctl's for channel switch, etc. This makes airodump unable to switch channels)

As a result you may get something like on a screenshot

Happy sniffing!

Crayvolt · Dec 2, 2018 at 5:25 PM

Who said it will not be an interesting , I my self appreciated your effort to bring this up. Kudos to you friend.

cerg2010cerg2010 · Dec 2, 2018 at 6:52 PM

Crayvolt said:
Who said it will not be an interesting , I my self appreciated your effort to bring this up. Kudos to you friend.

Thanks. I wanted to say that kenzo development is almost dead, we've lost official LOS and keep losing devs.... So it's most likely we'll not see working packet injection (cuz devs who know driver's internals better than me are left), and, possibly, a wrapper library implementing the default ioctl's (like channel switch) used in most programs.

Crayvolt · Dec 2, 2018 at 7:04 PM

i understand, hopefully we can have new devs. who will continue

aldhi · Dec 3, 2018 at 4:40 AM

This is a perfect news. At least if this device became obsolete, it should still be useful to be a portable linux pen test device, if possible. Anyway, awesome job mate. Very much appreciated

Sent from my Note 3 using XDA Labs

Crayvolt · Dec 3, 2018 at 5:21 AM

you dont have permission to capture on that device sokect operation not permitted

cerg2010cerg2010 · Dec 3, 2018 at 7:06 AM

aldhi said:
This is a perfect news. At least if this device became obsolete, it should still be useful to be a portable linux pen test device, if possible. Anyway, awesome job mate. Very much appreciated

Sent from my Note 3 using XDA Labs

Thank you. I forgot to say that monitor mode requiers support from firmware (there's some code in driver that checks for it). Kenzo guys are lucky because we have it enabled

. There's also sta+monitor mode (so you can have working wifi connection while sniffing), but it also requiers support from firmware and kenzo's fw compiled without it. I forgot how to enable it, but i think you need to issue "iwpriv wlan0 monitor 1" in default con_mode and check dmesg - there will be a string that says it's not supported (if it is not).

And if someone is interested, our wireless chip is wcn3680b, simmilar one (or same, idk) can be found in nexus 4 (mako)

Khimin · Mar 9, 2017 48 4 0

cerg2010cerg2010 said:
Thank you. I forgot to say that monitor mode requiers support from firmware (there's some code in driver that checks for it). Kenzo guys are lucky because we have it enabled . There's also sta+monitor mode (so you can have working wifi connection while sniffing), but it also requiers support from firmware and kenzo's fw compiled without it. I forgot how to enable it, but i think you need to issue "iwpriv wlan0 monitor 1" in default con_mode and check dmesg - there will be a string that says it's not supported (if it is not).

And if someone is interested, our wireless chip is wcn3680b, simmilar one (or same, idk) can be found in nexus 4 (mako)

Can you ziping code and flashable instal on twrp?

cerg2010cerg2010 · Dec 8, 2018 at 2:57 PM

Khimin said:
Can you ziping code and flashable instal on twrp?

There's nothing to install except iwpriv binary... But OK, I'll try to create a magisk module with enable/disable scripts.

Khimin · Mar 9, 2017 48 4 0

cerg2010cerg2010 said:
There's nothing to install except iwpriv binary... But OK, I'll try to create a magisk module with enable/disable scripts.

Thx, im waiting

cerg2010cerg2010 · Dec 8, 2018

Khimin said:
Thx, im waiting

Ok, I made it quickly!
Source: https://github.com/cerg2010cerg2010/qcmon
There's 2 scripts, run them from shell:
monen - enables monitor mode (you can specify configuration in the parameters, see system/xbin/monen)
mondis - disables monitor mode. You can use your wifi connection again.

Khimin · Mar 9, 2017 48 4 0

cerg2010cerg2010 said:
Ok, I made it quickly!
Source: https://github.com/cerg2010cerg2010/qcmon
There's 2 scripts, run them from shell:
monen - enables monitor mode (you can specify configuration in the parameters, see system/xbin/monen)
mondis - disables monitor mode. You can use your wifi connection again.

Thx dude

Crayvolt · Dec 9, 2018 at 7:05 AM

thank you you are awsome +thumbsup

---------- Post added at 08:49 AM ---------- Previous post was at 08:03 AM ----------

filter expresion syntax error using command tcpdump -i wlan0
help please

---------- Post added at 09:05 AM ---------- Previous post was at 08:49 AM ----------

can you help me?

Perinban Parameshwaran · Mar 1, 2019

cerg2010cerg2010 said:
Ok, I made it quickly!
Source: https://github.com/cerg2010cerg2010/qcmon
There's 2 scripts, run them from shell:
monen - enables monitor mode (you can specify configuration in the parameters, see system/xbin/monen)
mondis - disables monitor mode. You can use your wifi connection again.

Is it safe to flash with magisk in note 5 pro ?

Perinban Parameshwaran · Jun 20, 2018 33 2 0

cerg2010cerg2010 said:
Ok, I made it quickly!
Source: https://github.com/cerg2010cerg2010/qcmon
There's 2 scripts, run them from shell:
monen - enables monitor mode (you can specify configuration in the parameters, see system/xbin/monen)
mondis - disables monitor mode. You can use your wifi connection again.

@cerg2010 Tried to flash with magisk in note 5 pro. System apps are not working after disabling the module from magisk it returned to normal. Any solution for this ?

cerg2010cerg2010 · Mar 4, 2019 at 8:57 PM

Perinban Parameshwaran said:
@cerg2010 Tried to flash with magisk in note 5 pro. System apps are not working after disabling the module from magisk it returned to normal. Any solution for this ?

Please understand that I don't have any "note 5 pro". You can send me logcat and I can try to identify the problem or ask your ROM developer to take a look (if it's not MIUI lol). Anyway, that's just scripts, so you can copy them to /data/local/tmp or /system/bin manually.

Op_Flashpoint · Mar 6, 2019 at 5:58 PM

Lol I'm a n00b what does this do? Is this a packet sniffer or something?

cerg2010cerg2010 · Jun 11, 2013 19 65 0

Op_Flashpoint said:
Lol I'm a n00b what does this do? Is this a packet sniffer or something?

Sort of. It makes your sniffer to work - you will be able to capture raw WiFi packets from your device without any dongles.

pion_sekolah · Mar 11, 2015 4 0 0

plis whats rom u use ¿

csleo17 · Jul 27, 2017 9 7 0

cerg2010cerg2010 said:
Ok, I made it quickly!
Source: https://github.com/cerg2010cerg2010/qcmon
There's 2 scripts, run them from shell:
monen - enables monitor mode (you can specify configuration in the parameters, see system/xbin/monen)
mondis - disables monitor mode. You can use your wifi connection again.

thank you man, monitor mode now working on my poco F1, using its module magisk + aircrack-ng

WiFi monitor mode

Member

Attachments

Senior Member

Member

Senior Member

Senior Member

Senior Member

Member

Member

Member

Member

Member

Attachments

Member

Senior Member

Member

Member

Member

Senior Member

Member

New member

Member